Extracted

• • Target

    b8b4efb98533e512e7d92f77633eacadf14187c931ac7e9bca6ba79bbf740282

  • Size

    997KB

  • MD5

    654a7e158253bcaa710c5d144151204d

  • SHA1

    c84db72f8cb0b6f56c4aa98ac04865cc5cbe8c45

  • SHA256

    b8b4efb98533e512e7d92f77633eacadf14187c931ac7e9bca6ba79bbf740282

  • SHA512

    80d6f4624391cca43929af8641f0e00e84c5277172f274d1c46bda98faef94d3e28a9227c9b47ecc93fff1a9b42e5cd7bffcc4ef237577fbd3bbe1230dd1bb52

  • SSDEEP

    24576:1y/wqeGAw59U8+4idj/29ct64iaSvDu+9:Q4qe05KjF298LSL

  Score

  10^/10

  healerredlinedubkadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1