Extracted

• • Target

    359624319378608433cc89ed7f3d12894988a7fbc74973bc834fb7ba492221c5

  • Size

    756KB

  • MD5

    29a5d79e2ce18f5b55b09954d78f7c2a

  • SHA1

    7dd80ae0a72aae410f4e873d6eb0c072a18bd30d

  • SHA256

    359624319378608433cc89ed7f3d12894988a7fbc74973bc834fb7ba492221c5

  • SHA512

    ced6933f8c16e48a87c84b3cacdeb966f2e6836ea226a6992f56229f1543e4417d22f18b3c534a1ef703ee4380510f1f893bb04fde87be3ddf99d1c9138991f9

  • SSDEEP

    12288:nMrKy90mVHlBvbWA+V4rSvj3ZB8V8h8HSZ+4XP2evlQNe/5tNiJ5M+EbDjt/FJPV:ZylfGX7ZBQW8HSXP2yQe5jCm+gDxnGnQ

  Score

  10^/10

  healerredlinedizadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1