Extracted

• • Target

    9a13a96bf652d9dc4b15211eea3cd290N.exe

  • Size

    562KB

  • MD5

    9a13a96bf652d9dc4b15211eea3cd290

  • SHA1

    ffbbcde6a171abaa381328adffb2072ddabda9d8

  • SHA256

    b3b797586f8f9ed3a694a378ab4a10899dfe9949923c84fc874e223491187773

  • SHA512

    239e4bf607748a6674da2f591aafb0434906b4aefb3a701dbd9d3a81074c1840908d61ac5084b9f2abb5d8d6bca6fab0650ca900cd546986ccd54f4eb3514dc9

  • SSDEEP

    12288:dMrmy90WKIVKrjEdUrIv7F/kS7ZbyntUh2+6a:7yhKKUro/kON6a

  Score

  10^/10

  healerredlinemuchadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1