Extracted

• • Target

    f2885875152d3a2605ce8ee4b9c01d565e0ff9bcffe70065f818a0e970884661

  • Size

    860KB

  • MD5

    e536682f4b7fa802cd60cb046b01ea16

  • SHA1

    90fa11b0b829816c0ef6c869d9219966e11b9eb5

  • SHA256

    f2885875152d3a2605ce8ee4b9c01d565e0ff9bcffe70065f818a0e970884661

  • SHA512

    837353f212a3837b952d448fd8580fd915b5313c11871d7000898f68c19577169d20bc9ba68375a6da58924d3e51049dc6589fa8b6596e097071373eeae3a020

  • SSDEEP

    24576:MyAoH9eCsjVDXIDNrWf+IZgci3TSJfhsIZ:7GbjVD6xWf+IZgci3TW

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1