Extracted

• • Target

    96f7a6e37ec8eede392563df34208e0a0bf30d5fde1a5b74d679718ba7032b46

  • Size

    537KB

  • MD5

    0627064fb73f91eb79384a2a54e8be1e

  • SHA1

    6fce5e0339d9e7a85984e74778589f02c1ecba1f

  • SHA256

    96f7a6e37ec8eede392563df34208e0a0bf30d5fde1a5b74d679718ba7032b46

  • SHA512

    5a4f7b7d08167f0030582e545d2baca6b0feaff14202fdfbf80f9ed5397cc1094075a210de365be8d639a1228561fe02c2647670ae966166b89cb67ea9d7815b

  • SSDEEP

    12288:YMrjy90qFB/JTqcfUT0EJ0y+5vqFYALBU4q:Ly1FTwTHJeiPK4q

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1