Extracted

• • Target

    fce6c02b8efab2829f38dc05a462fa272364be4306d5cca860756217add6b4a5

  • Size

    672KB

  • MD5

    a9487b469f94a597e4de16f5cb31013a

  • SHA1

    f94f4018a7f8d5c0537d3fa31e6d9176c8839411

  • SHA256

    fce6c02b8efab2829f38dc05a462fa272364be4306d5cca860756217add6b4a5

  • SHA512

    daa7e7368cbf7a180f0e03e93ef64f8568f8c3695d05564b542f3a811147954febb845b332269a8d8881e5e56e05aa425b3ce997a720fc9fbc07535f3f61cbdc

  • SSDEEP

    12288:pMrSy90Pe6Fb7C4Ae+WIo5rHVtPHObdrbm1JVYrN:DycvHR1Yb90J2

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1