Extracted

• • Target

    e1a5ba40b49fc7ce6857951001c17abf5f14a7d95cab8acb297d3b52ad6fa4b2

  • Size

    659KB

  • MD5

    bce3d875192cdaa80a4167359048e9c7

  • SHA1

    9b42affd17ed42b5bc5ba598099faa74b4adb6e3

  • SHA256

    e1a5ba40b49fc7ce6857951001c17abf5f14a7d95cab8acb297d3b52ad6fa4b2

  • SHA512

    63746e599ef0c91d75e816dfde01aaae9dc70cbef5022757528a71198e87cab646b5c07a32e4efd3a4311fb576970d2ed476231062281b6b7e54107b408f95f6

  • SSDEEP

    12288:oMr6y90C/gLOxQVUOY+MDhnouDexo/vrijU1tmf5KVa/Qm7yk+gbZAV:iyD/yUOBo/vOjU1gAFmOk+GZs

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1