Extracted

• • Target

    a994918b082806da67e3873503edffd92500c5821949cc73368fb8be25bf2155

  • Size

    3.1MB

  • MD5

    2855392cec4f8929f43dfdee1304c984

  • SHA1

    07046d28bae2268a8e2608880b2b12010dc9ff60

  • SHA256

    a994918b082806da67e3873503edffd92500c5821949cc73368fb8be25bf2155

  • SHA512

    13689f5c4d6ea8c8d44259d3cbb942e2fe96b0a8520ec11da029e71a021f3619d83eeb2d79c2de1f20e5edf423fb1515e25c2affe32bd8e7520eeaf4c2d830a2

  • SSDEEP

    49152:8sSnXgA9x4vsraFn6a3vtvE5iFHIf/tB4INwvxWIx9hQXxHCy:8sSn0s98AiB+NYsH

  Score

  10^/10

  healerredlineramondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2