Extracted

• • Target

    e7ba1c42fc35b3975379d56baf47168fbb2e213cffc192905bbff0b4becac54e

  • Size

    1.3MB

  • MD5

    5035fc58fbe7e96a052c89109493399f

  • SHA1

    5cf34d42aa18f59c0014d1c6c8e379dc9cdccc5b

  • SHA256

    e7ba1c42fc35b3975379d56baf47168fbb2e213cffc192905bbff0b4becac54e

  • SHA512

    64babc5e6f30337e74e40d4b0e78a9066d53c5ac5a0968f27e5b4e29581f79dc3f49dc9908798669e1c69136441e76f1209893bf221efa650b3157a3d3b5eca0

  • SSDEEP

    24576:NymCVVkL7tqqD+YxtaY9UOKFwsgYo7eF4cmr5muoM97zh69UTvo:oXV6LZqqDUY9UOKFwsgY74/r5PHGU

  Score

  10^/10

  healerredlinerouchdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1