Extracted

• • Target

    e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30

  • Size

    1.2MB

  • MD5

    d73611ca509e3df6f539fa1402951811

  • SHA1

    b1d3094add29bc7325a7f7eeed0d723bf2e7ae36

  • SHA256

    e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30

  • SHA512

    7040168b6936202dbd81fa807a666120cbed09144c8e20be3950750dde505c71a33b790c48ab24be965af8299451c3c4fac4f4ead36cab53d6710ec452ff2126

  • SSDEEP

    24576:T74crraN9vX/M4w0C6syOXn6n1kAl+z9DZ6FhRnaS6zG:34crrcvX06OX6nei+DZSRnapG

  Score

  10^/10

  healerredlinepetindropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2