Extracted

• • Target

    2a892da211ca6c64e82deeee6ade8cecace7b89c8e534e05d47a2a8334b7c7cc

  • Size

    930KB

  • MD5

    3adaf24d1989bdf0316068a9d979b0f8

  • SHA1

    ec573867a14b2d3cdcf22c9482ef33d88804a4ab

  • SHA256

    2a892da211ca6c64e82deeee6ade8cecace7b89c8e534e05d47a2a8334b7c7cc

  • SHA512

    ce37e4994dc278d662add87a1b133d6bbfccfb43b569a01062f6a0f958095152f3a77adabb2bef3370446c57940a95b6df458232fce6738e70ac3b3c97f5acfb

  • SSDEEP

    12288:dx//yfYb5BIQZVtMdSGfwAIFyNsO/f2hY2YSKRZVEnzJsWNww3yMpj0uIgRPAB+3:TiuBtZVCUUXxSMwJNmOyMpj0uJRI+7

  Score

  10^/10

  healerredlinemonerdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2