Extracted

• • Target

    4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb

  • Size

    479KB

  • MD5

    d6d08f55c9b4a75dd763d6daae515294

  • SHA1

    9a0682464b8a8b2ef904cb43173cacfb1f291388

  • SHA256

    4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb

  • SHA512

    f678867deea09a47f97a76c15ed715a3281d44bab1d6e40191649904def4490d616ac9933c38654ba8f1c1300d0ed0093e14eec9ab143e29da3269a6256d8c7e

  • SSDEEP

    12288:fMrdy90CRQkg6bUzwmdcNkHba6WpOcLXw:SyhBTbmRmnpOc8

  Score

  10^/10

  healerredlinemaherdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1