Extracted

• • Target

    fbcf2ea288b93569dc3229062ff47c5648d281ec78d914fd22a7b3f6ad973563

  • Size

    535KB

  • MD5

    52a3ee5142c2a318d25cc598e3807f38

  • SHA1

    6a0a62157e74e192e548bec839ad0c52f5213646

  • SHA256

    fbcf2ea288b93569dc3229062ff47c5648d281ec78d914fd22a7b3f6ad973563

  • SHA512

    69ed3a82f098483eff5f40e218622aacddd5aff29e28a3e2f3babee7727733173860294e7c80092f7cd0efa6a64dc88b5ce253385994aa36a2f81b32aaba487d

  • SSDEEP

    12288:DMr/y90wLHnu+Mtzbq/k+jJ4A9NvnENWL1WDJaqYcPi:wyHLO+Mtl4vEEZz1X

  Score

  10^/10

  healerredlinerouchdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1