Extracted

• • Target

    4ab95c023ee3c92e0b748262892084d61bb52aa63c2269a3a173eedd4dcfac82

  • Size

    667KB

  • MD5

    543636f4f9f95ce2eab472f98161021e

  • SHA1

    b80a3d4d878d82dcae1030d42f93c38c06698542

  • SHA256

    4ab95c023ee3c92e0b748262892084d61bb52aa63c2269a3a173eedd4dcfac82

  • SHA512

    067e6770106fbe248613a93d7ac161b9e29357b784ceda9e75bc01336fa30a9ce09e0013de80bbb5f395f23ae42beea150dfc3cd0aa8235ebac73c5ebee46d58

  • SSDEEP

    12288:YMrTy90eBDu00pTsLhu1dm7mK2ZziYM1RzrUbJH/w3nfCKS:7ydEpTsMdfK2ITXzrEfwqKS

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1