Extracted

• • Target

    b3049d1cf44c86b9bb0b962679e372cc31982879695529f49716109a95c715a1

  • Size

    696KB

  • MD5

    ba81849edd00e6413c9ce430571000ac

  • SHA1

    7a1d5dd4938dd6c38553d3cdf25a5f4b6ae7ba68

  • SHA256

    b3049d1cf44c86b9bb0b962679e372cc31982879695529f49716109a95c715a1

  • SHA512

    511b9b17b6658ba47bee7ba1cbb73368e3d1debcdef4a553db9d3239a96165d2178c98b148d22b82580b7115859a820a311517192f70513e0ad54cc48443880d

  • SSDEEP

    12288:TMrYy90eYTVK+bCdyridaSIkdSYxHbZvO+Y7NlH3OM3fycYjXap5pk5obvYi8N6l:Dy4VKUCgEFIkdSS7Q+Y7SMvDV7YpN6l

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1