Extracted

• • Target

    1050a78f8d2dae2a807468440cee41c2b54add236775376a9d1133b50a569957

  • Size

    3.1MB

  • MD5

    720d9f1964944abbe059b557deecf113

  • SHA1

    6c1374f692c82c09a9175742debc45b720094595

  • SHA256

    1050a78f8d2dae2a807468440cee41c2b54add236775376a9d1133b50a569957

  • SHA512

    4994cf4fea497f60564bc960cc1e102ad00c16a29270ec29f664b8ed5aece1488b908349411e673a6b89d27f142c499f9490e2dc9d02ceff3f1177d92e75dcfd

  • SSDEEP

    49152:3iFzUE1/x5XSke5ec6a3va3F+EGrxflng0AqkPUYm+FO+goH:3iFzvSk12fpghqtYz8+go

  Score

  10^/10

  healerredlineramondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2