Extracted

• • Target

    16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132

  • Size

    3.1MB

  • MD5

    b0c402d3ffde0431353328b720814663

  • SHA1

    382eed9c15c8508e1c96d2176e2f9209eca1b27e

  • SHA256

    16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132

  • SHA512

    2de984feabfcde9adff04848294d08ffe52e4179ecb6b56433e216e96f41f8ccdbccf25046cfaff99f7fb0d1cd3ea743ec9569e50f61e2e3a020121011b4d0c8

  • SSDEEP

    49152:SqFTg0pXxVm8qBiU6a3vj459/z73GJgfVKSOFHdaiDM:SqFTi8VL5X/fvoHdND

  Score

  10^/10

  healerredlineramondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2