Extracted

• • Target

    4f25ccc7579a98b3168e05b7b046904fdfa68093895c8fa95c567f28df8e9c71

  • Size

    993KB

  • MD5

    ba120be22f4f3a6527070ab5466ba3cd

  • SHA1

    2587bf145333a4df2e68f82659921f959716d222

  • SHA256

    4f25ccc7579a98b3168e05b7b046904fdfa68093895c8fa95c567f28df8e9c71

  • SHA512

    ebb9a666fbd62cd14940a77642751ed3c13fcc938e91032fe114a455001d358c7dfdbb21b903c88e785e213e367a557fcffe4b9b53f7b88f0e89b9c3fce0f0f8

  • SSDEEP

    24576:8y9bv7aP+3XgW5lgFnBbYWlu8AM2INLUo3MHfADQ5kAGAK:r9bv7aP+gW5mR9FwFoUyJK

  Score

  10^/10

  healerredlinedioradiscoverydropperinfostealerpersistence

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1