Extracted

• • Target

    9d7a5d622c5dc674f807481a75538e428726f9fddc0bae92f0386872b836cf78

  • Size

    2.5MB

  • MD5

    c7aa507769ed79ca4b2fbbe0f2282786

  • SHA1

    589af08e6e6cd4cf419153e45f62923a83c6548a

  • SHA256

    9d7a5d622c5dc674f807481a75538e428726f9fddc0bae92f0386872b836cf78

  • SHA512

    f17cf2fd122a7e95076b5fa5945ec9bc71e96d4d6dca325e8c61c3c6e821c8fab2078e39ffa8a9b927e91506ee60f9dc14bd359b3c51893fb4ca259c59a52a99

  • SSDEEP

    24576:mtJ/Wk32Prtjh1Ceaz1op/Njk6a9DhvhgXiqVQLoWE8gQQZyNV+17:qlcrtjh1Cqp1g6a3vOyUQEpP

  Score

  10^/10

  healerredlineramondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2