Extracted

• • Target

    1b25c2d121d368fc96ba600662abff3b7ac9f633103943c7f35b240824b3c09b

  • Size

    548KB

  • MD5

    ed9eca632ae0864001c31ee535d76724

  • SHA1

    093ec5d38974b00fd955913c72b86dfe6f0ac492

  • SHA256

    1b25c2d121d368fc96ba600662abff3b7ac9f633103943c7f35b240824b3c09b

  • SHA512

    3c9e12bc0799053efe00c0b1afc754d26a8145888a4b923aeafa235299e428e079b3e4e50855f974cf85a7f2f083e52538b0f7d293b493e2a8c706702429d4a6

  • SSDEEP

    12288:fMr4y90ZlS+zQ98D123+cEnjmasysrqUbK8MLJRCPyzN:XywlShA43ynjWbKjWPON

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1