Extracted

• • Target

    70a0d32d21958c210fc9eb09c20784a6c6b05ee9463d8256068683536a145f20

  • Size

    1.2MB

  • MD5

    0be1159f3ead78079969260b9f4d3f88

  • SHA1

    1d4754a1850f38190d06ab772aa7e7e50e1c69fe

  • SHA256

    70a0d32d21958c210fc9eb09c20784a6c6b05ee9463d8256068683536a145f20

  • SHA512

    0bcb3c19aa75571b291c321abde128a3e4db208a01b41ed31a27d8e54f8f1761163fdc2e63a5a8aba61cc227e6fbca889b77c0e3d408ea3d31e301fa31861dd5

  • SSDEEP

    24576:9nLCqjLUI8q58upBK+vy+S2/Z8qqBrvDIV:9LNjLUd+bpBKqyc/GP

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2