Extracted

• • Target

    cf59ac4a3eaa65286db8a2f245d6d50b26abae6a2a015c040e4ac7339319f335

  • Size

    530KB

  • MD5

    c2926e715bbc10c2705754a55a594341

  • SHA1

    c6fad5f6cde9b8074ea0c663ab675fc8243a8ce6

  • SHA256

    cf59ac4a3eaa65286db8a2f245d6d50b26abae6a2a015c040e4ac7339319f335

  • SHA512

    932b1f1e8cafa164085bb2a35c7f97d0ec67ef948eba19a2fd1f813ab7eb39addf2926bd52b4cd9e9f63bef9052a41231dbb36761080f51d277d63fa6be58095

  • SSDEEP

    12288:AMr8y90oBvQ9uNs1445TWAg0tn/6d0E8VxTXuYExT:Myny9uFQ3i0E8/wV

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1