Extracted

• • Target

    0bcf13ed69fb91c4fe09b790ab70ab1c36de28a7282cd94c5afbcf6bfc7abb9aN

  • Size

    480KB

  • MD5

    941a632d5fbe67520980feff5be3e0f0

  • SHA1

    4b50ac6c09e18add8a7058e9d05be7f008bd2a50

  • SHA256

    0bcf13ed69fb91c4fe09b790ab70ab1c36de28a7282cd94c5afbcf6bfc7abb9a

  • SHA512

    fa4365df81d8acd800fa8a05710572410127c4d70430b6609f463fe5ef7620e1a6844e7f7312a746a9f77e1ad2e2b56e18a6cd6ffa1d327aab06481680234b98

  • SSDEEP

    12288:bMrhy90SSpVJ+7c8kqOafPG6UAiDvtI/17D:uyzYOIeOIG6UAqFI/l

  Score

  10^/10

  healerredlineviraddiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1