Extracted

• • Target

    2ad1213e958dae604444fc34a6386106abb8837e99e32c808bc226ad710af599

  • Size

    1.2MB

  • MD5

    1b8962bc9a8e8e0afa67fc70a6255c48

  • SHA1

    6d43629096cc2b646dab105358385797f1f5a730

  • SHA256

    2ad1213e958dae604444fc34a6386106abb8837e99e32c808bc226ad710af599

  • SHA512

    c4805b94042d3dddcecc064b3d9d1f810cb0df297afbb7ee26b33e83c64cd48342c984cc0793707baf3b972de5767cf872da7a9f285db2245fd41041316ec50d

  • SSDEEP

    24576:0UvRwbo4a0xFJH67sBCJYLW7XpAy+q32kX9VEcboU3Y2tGnwli7:XvRSoM/JaQBC6W7XilqlZ3Y2tCws7

  Score

  10^/10

  healerredlineramondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2