Extracted

• • Target

    6577a41390721769ecee7379259f3679e92913275d7fbd794fa33ed52203b904

  • Size

    677KB

  • MD5

    95bcd22e01cbce70798fbb3b3dba28de

  • SHA1

    a36190f7b0da7e42feafa465af742045e585461c

  • SHA256

    6577a41390721769ecee7379259f3679e92913275d7fbd794fa33ed52203b904

  • SHA512

    68abb64d480625e9adc8dbb3b34c8f161762df9485c8a101d8c51e79d4bfd85a82e8d594b51ba1d64089c5fa953ecba87384f9d954d43db3e513edc08cc33712

  • SSDEEP

    12288:DMr1y90lEqaqiT6je+x2UsavUxjvR1dE0l6enZ28j8mbbLk7nltCrrMt:KyGtFiAe+IacpzdnLnM8jY7TCrm

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1