Extracted

• • Target

    defb18cc6c97e48c0d6da08a7a0c96cdaba85374aa0e25e4be7f26014beb81ec

  • Size

    392KB

  • MD5

    a19a155d64c988bc96695532d9dccc8e

  • SHA1

    5f1cf57537b28e9066e2979617db98686f46d94b

  • SHA256

    defb18cc6c97e48c0d6da08a7a0c96cdaba85374aa0e25e4be7f26014beb81ec

  • SHA512

    389a4af57fa24922c5efc1fd7cdf011af179eafab99af8242d3329061f3bf91c49214b6b8db55c0f936838243b4a100b13855aedc6a405d763dc9b65de2bb207

  • SSDEEP

    6144:Kzy+bnr+Bp0yN90QEaaLeaUAjviz02E9+zqBbQlbJVeAJT8zl/D4aolh61:ZMrZy907eaUAjY029aQp0zWa1

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1