Extracted

• • Target

    115f6d1d787b2014eb9a11b2c68efaa894b0ad783f068ae34911a59c1e2d7472

  • Size

    667KB

  • MD5

    d2ddd8631e7e8ab2b19789aa14ddb113

  • SHA1

    e21aa131a83c89a1645dbae535576373f0f4293d

  • SHA256

    115f6d1d787b2014eb9a11b2c68efaa894b0ad783f068ae34911a59c1e2d7472

  • SHA512

    629a792915dbf863a7c2901cc76fe016b08f66fd79aa6a44289806d3078264b31b79b150ea952f235aa443819a73e32533563cd475c8a019941d865f6c3e9741

  • SSDEEP

    12288:+MrGy90ajqV5pDbh7qM5nmulDUBsScULLW7S0nZqDdwbMu9us/s:0y9jqVvDbhjntqBTchoDdwHup

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1