Extracted

• • Target

    156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb

  • Size

    1.2MB

  • MD5

    057a0f1fbedc775aacf74f713f7fd426

  • SHA1

    6e58f222f68fe7ef3b2f6bb355e0799137fedced

  • SHA256

    156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb

  • SHA512

    2970bd0353388e0f3ec6de955fb8c5a2d47f753041e0234730dfc210758d9e46b7691555292b366bff740cfdb7bb4b7ed0d686e1ce519af15b62f066c9f6bc42

  • SSDEEP

    24576:731rUbB61caZU1YezvhG2gT1jYvqfmBEPC/i:b1r+Icags281jWEPC/i

  Score

  10^/10

  healerredlineramondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2