Extracted

• • Target

    202e690447812603792d0a7bebc2657f724623bbbc418e35805fdbc975397120.exe

  • Size

    738KB

  • MD5

    7a86c899903d0a6dc4d85a577434c6db

  • SHA1

    101534da15517334cd02368e0282aef11d368a7e

  • SHA256

    202e690447812603792d0a7bebc2657f724623bbbc418e35805fdbc975397120

  • SHA512

    8e0cb4f764c37bc0846c193931790036b2cfb9928d34fccb69be7152ee89cdee2ab2642091be31c15c66d7fdd2d9e45c5525774022fb1052512972b04fc66b7c

  • SSDEEP

    12288:4MrHy90+FrUG3YB60FXccGjC3AM1DuWvk6V/2MNY2S0S0obzeG15Mo3DQCotd71V:fyLALIFcRW58VS0KbzLPzQCyci

  Score

  10^/10

  healerredlinedizadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1