Extracted

• • Target

    03a604d08abe6e708f7100e0643409a803d134d03c6575fbfa68655027f166a5

  • Size

    3.1MB

  • MD5

    4998e293623bf8a3b2dcc64243a4eb4b

  • SHA1

    c679f2883e2ac3ebeef22197961af51e437780b1

  • SHA256

    03a604d08abe6e708f7100e0643409a803d134d03c6575fbfa68655027f166a5

  • SHA512

    3fd4f251b0402be28a8d1732d2b6f5046f6571a6780b65d821420ca4a72e677e9919f064d24880aa48135a3fe2b621e3ddb1328205cb883c0c4e633b09689a24

  • SSDEEP

    49152:zZuDVNnhrahRC8cs6a3vd2vS+xmYhOq2kxE9HbWKATwThL3TV:zZnhkW+8Ysq2GC7jATch

  Score

  10^/10

  healerredlineramondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2