Extracted

• • Target

    d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b

  • Size

    930KB

  • MD5

    4697b533d9be35351f1742bb0fa26f94

  • SHA1

    06fcdb6fd8172cbcbd27ebb340905d989630475b

  • SHA256

    d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b

  • SHA512

    93ed2e98d76da352f8c83a1142c11bbcf3ebcf79e38d140fbae14fc1c4a719d8b39bd9fa732de02f09a1273bc9782e9a710c7b40a3f1356acaf411cf8e05a459

  • SSDEEP

    12288:gl//yfYb5BIQZVtvffdXWOW1kyOqJ6xM1FKGv4YVnGGwfZhi7p6gA2ni5BVObHWM:YiuBtZvfdGOUkM1fnwG6gAzV+HWi7

  Score

  10^/10

  healerredlinemonerdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2