Extracted

• • Target

    9e42f3b3bbe2494259d65671f3190341a2cd36a1edb4ed11a67a3db56bc9106b

  • Size

    561KB

  • MD5

    d4f1f202afedcf09bc0fb3d177e027b2

  • SHA1

    8c7b41d8c9f0cf93f8004f899acb5d6eaf85711c

  • SHA256

    9e42f3b3bbe2494259d65671f3190341a2cd36a1edb4ed11a67a3db56bc9106b

  • SHA512

    2e40eab7ae2459f99e9447917b3694a0d3c57d20c5cdb89305a7a82055e0e896a063afa83f83bb9fa79521e7c0173d0c35f244a2be5c4f3caff565894960ffb6

  • SSDEEP

    12288:lMr+y90wahlywIM4kdcM68AeXPMi9DBtDHe9O:Py/IlTdcM6AEcDzDHe9O

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1