Extracted

• • Target

    28e6dfd3ecf619aa2b1178daa7c7919aaf67760bce92aca6f7a7c270df6e6602

  • Size

    1.2MB

  • MD5

    43e7f062a44f69332ed3f9ce3bdaccce

  • SHA1

    5419e86e26aa86ad29e54caf13d2477952267801

  • SHA256

    28e6dfd3ecf619aa2b1178daa7c7919aaf67760bce92aca6f7a7c270df6e6602

  • SHA512

    3f43a296df1829b782683b92413a5a6b33ac454304a864f038f94817065066a5e91b50f5dee87b2cd327498777c687d781017dd33ca153e43aa37ff1b88e2046

  • SSDEEP

    24576:ryLb0bnq2EFPU8uRi1BYlMkfKMv+Qh1NQwT3Pizgl1muihwF7:eMnG+SBaNNNj6zCW

  Score

  10^/10

  healerredlinedomadiscoverydropperinfostealerpersistence

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1