Extracted

• • Target

    145089eac4eee464f440bc6df141bb1eb04a043aa92673f4e0b30632d63f7f0b

  • Size

    3.1MB

  • MD5

    5b9ec3fae99bb92e75e9a1f015b3243e

  • SHA1

    3c5e818c028c64749214c759ff770ddfb29520ae

  • SHA256

    145089eac4eee464f440bc6df141bb1eb04a043aa92673f4e0b30632d63f7f0b

  • SHA512

    a46bd9129c8bc108bc3af261e3318849c60fe38ea3713b9a1ebfdf7f62a82d9217a21a9f4864236961a6b3dc09e3c2678aa2b78eac5d618d1e356dc42091f5bc

  • SSDEEP

    49152:L0G61NSHhsXL1pxR1d6a3vMUMduYJIWk1KvYY+rClyuqsTgj2mM/7:L0GoL1AAMwYJIWkQvYDrZVsE6

  Score

  10^/10

  healerredlineramondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2