Extracted

• • Target

    f0584ae0be376dd96faa20bcc1e2a48d283e8435333b3fa790d3c147dd8db41b

  • Size

    864KB

  • MD5

    a8e7a5296daeffef07c5a2b128bd1e00

  • SHA1

    92052b515d58ac65541792b4806fffceb5169712

  • SHA256

    f0584ae0be376dd96faa20bcc1e2a48d283e8435333b3fa790d3c147dd8db41b

  • SHA512

    72123cdc2c6093dd7d47c4c8d12a4228a20f11bfc08ac29368a16aad579c26ca5f7b09f4e26ce97467532b2505bfa9cc7408dd0f32fc8b0dfa92e92b7b75759a

  • SSDEEP

    24576:2yfGMaAt53Q7w/3eWa9NLY/mBWEWx2iIWd:F6Atp8w/3ebU/qWT25

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1