Extracted

• • Target

    aa61252df952bbba53e7866ed497baac1cf3b8a6975a788eec3ca738c11504e5

  • Size

    687KB

  • MD5

    ecbcecf8ba242a8d914d33356bad6553

  • SHA1

    ab6beb8d3ce9cb34232b59e9705b679db2b76b01

  • SHA256

    aa61252df952bbba53e7866ed497baac1cf3b8a6975a788eec3ca738c11504e5

  • SHA512

    ac8a1f63b8d3b93741a142a14c8f7c89a91141411a299d245ba5e4ee7cf6a4719ec4506e7f45b5cd057f0ab4f8df04c60c2480f93d688c87609a08bdfaeea187

  • SSDEEP

    12288:lMrqy90zlqOiyK2b4rE5jnoUtTyIWcSliB7tA/syi1BRVUllBMjzuk6jcPFZYRiZ:fyAqOiRO4A5roURy3iB7ykhUl4vUNE

  Score

  10^/10

  healerredlineborisdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1