Extracted

• • Target

    ca2ad17b64a10b961c2b14a7e47a8030_NeikiAnalytics

  • Size

    307KB

  • MD5

    ca2ad17b64a10b961c2b14a7e47a8030

  • SHA1

    a339ebb686b832fc87af3c287f67d8ef52e140e8

  • SHA256

    23bc83a4a63831c87e6d79e2b366e2534c967a13a377e66f4d92e226f9e8be94

  • SHA512

    ad5e5a03336562d58b02f2556eb833fe3c39d2a7c47584379059cc5a584be1efc981cde4c84a350a4bb244502a73fb7bf0bee7b03b4ef002bb6ecc17d3caff04

  • SSDEEP

    6144:Kqy+bnr+2p0yN90QEw5F5OYc1u31g4TByUo0b4jut7dJdVRbpDXtOBC:uMrCy90qxc1u31TTEt0cKt/tOA

  Score

  10^/10

  healerredlinedumuddropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1