Extracted

• • Target

    f15c1027833e358527334c9fc6b59d1d917d755320b0ace4cb989f76983afea3

  • Size

    1.2MB

  • MD5

    41407e75c58bae34564d347697cfea2b

  • SHA1

    e11e1cd0f5eda978fea5bafd1c442a506346890b

  • SHA256

    f15c1027833e358527334c9fc6b59d1d917d755320b0ace4cb989f76983afea3

  • SHA512

    9acde0efc338e6e47a91ecd5dd3aff3c1b02dcf1a49bafa6563660136643663a22fed47695b203b179b9e7e5aa15af03796ed056a67e2ea42f135eb5a37f9c54

  • SSDEEP

    24576:z74crMzMVZrNESV5H3GsXERjxYG4UFwxDMfG:X4crxrN5p8d42wxDMfG

  Score

  10^/10

  healerredlinepetindropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2