Extracted

• • Target

    e18706af1ae9a815cf1256a7b000fe00c293b77b4b45655fe81096a6a5121d0f

  • Size

    765KB

  • MD5

    f199c8c303f55c5d18842e1997e13208

  • SHA1

    3dc56a32a2af84cf60c9fb950f2e7d249230c733

  • SHA256

    e18706af1ae9a815cf1256a7b000fe00c293b77b4b45655fe81096a6a5121d0f

  • SHA512

    44e7557a3e818a2d1cc6a8a0cd627faebbc798bc783c4b4587ce1fd6486b71f6070068b190a64af64cc54f65c5edadd5500480d1f5cb8ebc5c5e05ae39ddfa24

  • SSDEEP

    12288:3Mrwy90mS9Dg3lfQBjO5gZ054jnt5XSDpUA3eesuEnWmnWS8dRzAaNUBXXugutsW:DyVLp5gnt5Spn3eeqn9Wt2aOBugutstc

  Score

  10^/10

  healerredlinedowndropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1