Extracted

• • Target

    bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa

  • Size

    930KB

  • MD5

    3460167c1d4aa82be63e7d58086d4dc3

  • SHA1

    698a2c76dca22b0434f435fa686b8e16d3c09e07

  • SHA256

    bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa

  • SHA512

    79ab6533342e459d8d2c9602938541fdd9388dfa0fdd74c3d7ce2ac429a3a30da1b9cfc185312614e176ea8ec70540f729b92e651dce570baf0808f3f22441ac

  • SSDEEP

    12288:d6//yfYb5BIQZVte2f8sD5ARNRDDyBPd0mWuh1eueMbQkXwSUqf7ZOqPMeIX9iDF:giuBtZsDM0fuuuw9qZFbANhTil+85

  Score

  10^/10

  healerredlinemonerdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2