Extracted

• • Target

    b1087dfb211841a764632385f1e75cc180817fae723f97d02ef7a8b2898a0eef

  • Size

    534KB

  • MD5

    e82003c412429ba0c86b80b300220dfd

  • SHA1

    5d24bfd184cb2603e33a8b1a7162cba781f98678

  • SHA256

    b1087dfb211841a764632385f1e75cc180817fae723f97d02ef7a8b2898a0eef

  • SHA512

    1bdc0047ecfbb77e116d59b242e17590d80d108446ee9110b4590950e9393e1d06a872530ca1a2b39f60c9344dfd53e1ebee8529770204e45876f925a23274fe

  • SSDEEP

    12288:GMroy90ZE0A2VCZGxObkdNoWZXwP4atx/cLi9XEA:6yCAGCZbkToWBwPdA60A

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1