Extracted

• • Target

    0d49c2d3cf9ae5c0f75d3a33f3bd5ce19228a8f2f6b8711a1dc207dbb1a75baf

  • Size

    1.4MB

  • MD5

    7e4b05999f3157f1d3327cdde61620a5

  • SHA1

    c4ebe871cb835699c8cd59f8182aa5b07ef6d560

  • SHA256

    0d49c2d3cf9ae5c0f75d3a33f3bd5ce19228a8f2f6b8711a1dc207dbb1a75baf

  • SHA512

    cf606c46712af6c25efe0b8b51f19442f1018a56c1b0c6551c40606f28d37d17d3f7075cc948200d2f2012b32685d661294f329c89ff138ce3675baddc67ac72

  • SSDEEP

    24576:rydG19dotlhF9+4osbnMEqRGsPnK/KvzUWLdpim+Q1hw43XLLi/vp3mmz9vG:ew9dq3gt6NqK/WzUWLdJvh3XLM1

  Score

  10^/10

  healerredlinemaskdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1