Extracted

• • Target

    6dbc490c365d8e1f18044c9b64991ec2f725d4175b20c916b063eb6b63513c68

  • Size

    553KB

  • MD5

    eae29f4ebc0c1f47527c52793dd041f2

  • SHA1

    bb524b0562ae4f7bfdf22c4cd606e43f383018f2

  • SHA256

    6dbc490c365d8e1f18044c9b64991ec2f725d4175b20c916b063eb6b63513c68

  • SHA512

    0647c7d76bdd244650f8962e4293c40160b46b543542de5d4bdca42919f2e4939e6d4ad7b403765ed0a6e7ab0814758fd831c68b44abd860700b9c6cf137080c

  • SSDEEP

    12288:zMrby90Op1/c80A/qMMFO7HKXFjJiNZ0AB7Vnhc9Qs6qIcp7:gyvp1080GbMFO7SFjKZFDhc9QsvF7

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1