Extracted

• • Target

    67f34cd3a25fac8ed0a2712f4a8b358cd870cbe842d5a925eabe413b3b15a3fc

  • Size

    789KB

  • MD5

    31c6e14bc4a6bf3c8bf0317c28f63863

  • SHA1

    bd328670a52c297ccc5569a9b4ab2a0f5380b03f

  • SHA256

    67f34cd3a25fac8ed0a2712f4a8b358cd870cbe842d5a925eabe413b3b15a3fc

  • SHA512

    118871b46885888b7c135dfc2d395805198c09bd88a3693700dccf8d5d6321bbeb595b3ec54a5ca4ecc565231b7d5f6b3f732caebcf9429bd541e089348f0a04

  • SSDEEP

    12288:nMrIy90xiG8XC77+FyvLvPkhq6QL78oLnRzzO7jud5wgFX6UTbFnh5WP5GqxI2TK:jykd8SXASLvPb6a7Lki5LFqoh5WYXr

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1