Extracted

• • Target

    9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029

  • Size

    688KB

  • MD5

    4851ac3cf7c5d5c81e5ba1a9afe910fb

  • SHA1

    db23fd859737d11768fd21c59a5372ebea17da33

  • SHA256

    9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029

  • SHA512

    7cc28b18ecb9ed0b272b903e91b8ab27e742d941b1af655511836a6303d27901e4e3291f4496bd9cb57eeefb6beb2fdb3fff475c94471d65294aca8133f83794

  • SSDEEP

    12288:5Mr9y90gCViu9ARRczfIk8oHCCym65hLuf/K3vuSYrf2onqmJ4vpF6Lfiggjqa3/:0y2+RcriPtfaf/K/udrfdqmJ4r6LagRS

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1