Extracted

• • Target

    1873131a59f87d8eb2282a397a9d5605b35abc817efb91a238a15e7a12b76ac2

  • Size

    659KB

  • MD5

    dbca1f5adacdecfbdfd0177cfb0ff064

  • SHA1

    bae48bc7aa8377351374f195d153160060981561

  • SHA256

    1873131a59f87d8eb2282a397a9d5605b35abc817efb91a238a15e7a12b76ac2

  • SHA512

    fb9936dae35fa3997b90eb44d57700301d46dc384a59de3ae8ad87f55862ddfb09d1dc23bdd948dc9b3ec693f3150d4f4de0fc64d9c9d83a16803585c35f187f

  • SSDEEP

    12288:iMrBy9001GBV8p1cjG4Hva48RjRHVu1v9KLYRIfo0NiGHMw8fl:jyHGVj64EXu1v9KLYRIfo0NfHZ8fl

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1