Overview

overview

10

Static

static

3

396b13a0a6...6d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    396b13a0a6cc1c09e169820a1fb8675f7df7198c18792dc14bf25df06dc6b26d

  • Size

    479KB

  • Sample

    241104-q4hfra1dkr

  • MD5

    d51dadc0354cf8f0192b3dcd2f00b4e3

  • SHA1

    94156f83da9c16dc21aee1525973cfe268cfd38d

  • SHA256

    396b13a0a6cc1c09e169820a1fb8675f7df7198c18792dc14bf25df06dc6b26d

  • SHA512

    d73245c292ef8b207b91b03623cb1e46b5487dad5d7291a561d8fb3c770aad33938800514009a1e87ac93fd71ddd4715e808cbd8b5c74e5198d17751b8f17784

  • SSDEEP

    12288:6Mr+y90yw6J4MGtbQR7PfXmyGvOnbd7Gdc:kyA6qZtUR7nWyVbb

Score
10/10
healerredlinediscoverydropperevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      396b13a0a6cc1c09e169820a1fb8675f7df7198c18792dc14bf25df06dc6b26d

    • Size

      479KB

    • MD5

      d51dadc0354cf8f0192b3dcd2f00b4e3

    • SHA1

      94156f83da9c16dc21aee1525973cfe268cfd38d

    • SHA256

      396b13a0a6cc1c09e169820a1fb8675f7df7198c18792dc14bf25df06dc6b26d

    • SHA512

      d73245c292ef8b207b91b03623cb1e46b5487dad5d7291a561d8fb3c770aad33938800514009a1e87ac93fd71ddd4715e808cbd8b5c74e5198d17751b8f17784

    • SSDEEP

      12288:6Mr+y90yw6J4MGtbQR7PfXmyGvOnbd7Gdc:kyA6qZtUR7nWyVbb

    Score
    10/10
    healerredlinediscoverydropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks