Extracted

• • Target

    d923ab817a8424a2fc2fabd40600603e5d2bf76a12d918d0a0285468efec04e3

  • Size

    693KB

  • MD5

    2008fb5d529bda2fa60178e61bbe5ada

  • SHA1

    c84166ee80f91e38b68cc83338c748758f77e57f

  • SHA256

    d923ab817a8424a2fc2fabd40600603e5d2bf76a12d918d0a0285468efec04e3

  • SHA512

    15d65ee5e8cd8903f1b915eabd6cbca3cb4c7e7c09fc2dc9f2fd6493c4bd4e06b541d7ad4689cbef28c53d2c4e57355d8fae4b6ce3eb011570c8683185722252

  • SSDEEP

    12288:0Mrly90KuxQOVl0fqRHYumDpDBdeGBhbMHElamOAO+x8ls3sg:RyNuxQffSHxmDpTfBCH0u8H3R

  Score

  10^/10

  healerredlineruzhpediscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1