Extracted

• • Target

    794da2c962cb4a1f2df6f0d966e94bc0ef08c6b20138ffd0f2f8e7d6d9cfd7b0

  • Size

    666KB

  • MD5

    86d80efcf39ac0644815a6a7793b4e07

  • SHA1

    abf36fbcb4de003a0c4acb063a3752ebfd849298

  • SHA256

    794da2c962cb4a1f2df6f0d966e94bc0ef08c6b20138ffd0f2f8e7d6d9cfd7b0

  • SHA512

    b223b880c06f5ea76c80833d83d57b57b71e4c78b77c8641162fd5c12805bcc406ce7ab5929bb216de7da9813d63f422050912d91eae32afce1702a17502ee8b

  • SSDEEP

    12288:JMrNy9050p+mG2mpcnprJu/v78tWYb0fqH7IIDF0sgKkdyDBZ:EyCg+jcpVAv78IYgCH7IMh3Qyn

  Score

  10^/10

  healerredlinerouchdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1