Extracted

• • Target

    1bef0ca1c11598a519d4e6dc082aa09631f4d8c4c293381b9bd6190f2a9cc53a

  • Size

    689KB

  • MD5

    4a7454b47b8396f2bfe76551a9aeb72e

  • SHA1

    d5584b3eb4e9f2a1f76300374c1626e4a6cdab8c

  • SHA256

    1bef0ca1c11598a519d4e6dc082aa09631f4d8c4c293381b9bd6190f2a9cc53a

  • SHA512

    ef80f833d17d19c9af44f78dbebecdeb37f9a004d71943e1cc5f2de87e3e419b7437cbf2bc7c10992eb288ba16b34989d6007d524de443e96685ca19bf7e3e4b

  • SSDEEP

    12288:OMrAy901BFeLPM7KV8GP7Pz7P8t22KgYZ8CBvHIPyIXRMack+dBWzwqY:yyOBYKKV8GP7Pzz8ofjGCBfIqASnbWjY

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1