Extracted

• • Target

    176a1e6aa31b6853eec2e0ad64e2b85e59b4bb22ca48645f5c8bac32fcd38e0f

  • Size

    660KB

  • MD5

    4425a316150fc7d2cf0168779270992a

  • SHA1

    6f2fc4c6606e09009013be3df494812f6a42a4b3

  • SHA256

    176a1e6aa31b6853eec2e0ad64e2b85e59b4bb22ca48645f5c8bac32fcd38e0f

  • SHA512

    cfb2bffdf50e56281fbe99a785434c3f76937cacac1011147c98060cba32e3671d14317d1de58cc4ace3fcc836039ee86c8001e32cc08be4e61ebdd72de279db

  • SSDEEP

    12288:VMray90430k0GrAetSYptMQsSHKKO/R5MNP0MsxrLihilaWPdwrIyJban:Ly1f0ubtSmt5ZHXOHIPZsx6hil5u0yJG

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1