Extracted

• • Target

    eab3e27e19b610a1a1a8a23092835343e10f25e6c145be41f93e618a44e9bebb

  • Size

    269KB

  • MD5

    94d8582df5fde8a4f1e3e47b1a464b5f

  • SHA1

    d466d7326164cb6b0f40497b3629c6ea070b4cd0

  • SHA256

    eab3e27e19b610a1a1a8a23092835343e10f25e6c145be41f93e618a44e9bebb

  • SHA512

    2752d4e804e948fd26610646437c48464006c080b01484fb1ef51644cf3d0c7ba2d10a4bab1f8913bb7834696bdb6251c3a048c586301ac5db55fc7925ad1af2

  • SSDEEP

    6144:Khy+bnr+Sp0yN90QEf92P0yqvSnEFDtt6:7MrGy90ZEsyqv6az6

  Score

  10^/10

  healerredlinesmokedropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

  • Detects executables packed with ConfuserEx Mod

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1