Extracted

• • Target

    9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083

  • Size

    481KB

  • MD5

    0070587ca41767ceb2953a3b0bfdc943

  • SHA1

    854a15180aa67a01873f6788cf860c8c853b651a

  • SHA256

    9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083

  • SHA512

    7c264d3b57babc68795e26b11618c1e1ef959e5c03d3b08857b3e29fc83a8c3881c95800821d9409fd1855d0a12c00e8c374c65ba65110fccd790ab77834faf1

  • SSDEEP

    12288:eMr9y90DCA4EhbLTdbBecJWFt4uaXL2Z:byq4YBecEv4zL2Z

  Score

  10^/10

  healerredlinemihandiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1