Extracted

• • Target

    fa619ab9f9ad0e529fc25a81ddcb0a4c4ad848e2002cf80672ce7256105f4d95

  • Size

    548KB

  • MD5

    3700e201ef9e5f01449f86420750d5f8

  • SHA1

    ca909c329f14a4b858cdd62e5cf2ef14e94d6fcf

  • SHA256

    fa619ab9f9ad0e529fc25a81ddcb0a4c4ad848e2002cf80672ce7256105f4d95

  • SHA512

    be0fd750bc658be9fc35c874e9bd538ecbd386d028674c666a8cf44b8a2df1654817731271d96f908d1926d11fa44f8b1689c4a1cd6c79b55ab067f40107e2cd

  • SSDEEP

    12288:pMrAy905xVLjB18jd7qRdaMStd8Yy41vtI:1yYVoqaMSg8I

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1