Extracted

• • Target

    e3bea932e5a9db263454f9a5166447405b16067413b908e4da720e02eda773b2

  • Size

    522KB

  • MD5

    718f57e3196073a9f6e71f0516c6969f

  • SHA1

    bd9fc25fd92ff159d98a6bb4c409c8194769ab7c

  • SHA256

    e3bea932e5a9db263454f9a5166447405b16067413b908e4da720e02eda773b2

  • SHA512

    7d10784f69962b2907be20e6e5881d9458e28eb2f4a6b96ee98ab23661c5dd272a6385adee9c0d8e6003e0581771cea52ae0828aaf8adaeaec162bdecbe3dcd3

  • SSDEEP

    12288:wMrpy90njwHX7kiYlGbh9D8UA/i0tXMja1RQnmRb:JyOqX7GOnh0tXM+0n8

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1