Extracted

• • Target

    d9912f8e4fe99e13c9d579d3db102dc3a0a1a2cf0b3b34dbcb47baee488b6a62

  • Size

    3.1MB

  • MD5

    a2025e7e3aafc5626ff6f6006e55ff1a

  • SHA1

    46a2e3ba3c5ac7cf8b487bff576ce89f999d731c

  • SHA256

    d9912f8e4fe99e13c9d579d3db102dc3a0a1a2cf0b3b34dbcb47baee488b6a62

  • SHA512

    58f31b27711bf02d6b8f22a8322c18944194bd3cb3a9a9d584e5c6318a20648fb6e77bbe374f9993f53acfebec21531a6363652288682a797d734dfa3cf94de6

  • SSDEEP

    49152:DNiDVNnhrihRC8cs6a3vTWpJZSgvZUq2bS720DnT3u0iG6oOlGn4X/:DNDhksWpJAgCB+720Xu0X6op4X

  Score

  10^/10

  healerredlineramondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2