Extracted

• • Target

    073f3809c2174ab10a96cb22ed77f14e0c4f27067e736fa822b67e5151e81122

  • Size

    314KB

  • MD5

    274f3f1eff28ca61367b98872014260e

  • SHA1

    5e45776541c557936fa3194c0dfd687d58af7f6a

  • SHA256

    073f3809c2174ab10a96cb22ed77f14e0c4f27067e736fa822b67e5151e81122

  • SHA512

    5db8e35fdde3e46c58a933d63ee2c2a1e8fab7ac37e89f5f6be56439ec355afe96fdaa484ad7c6a6f89f907f906346f1244d2b4a053a9d978416ac072a7bcaf2

  • SSDEEP

    6144:KKy+bnr+pp0yN90QE40ne1HieCbh3yQX1mNu485L5UtVWptx2nc5D:yMrNy90a0neRCoGi8SHWD

  Score

  10^/10

  healerredlineviraddiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1