Extracted

• • Target

    edf7a4acf8e91bf7f240e7c3042794ed56fe39558d80bda3fdf19b40d3180973

  • Size

    662KB

  • MD5

    d3d84f149a051fc6a1fd0c0d168fde4d

  • SHA1

    1504998a04763dc5ddd27fe6f51dda5f875b35cb

  • SHA256

    edf7a4acf8e91bf7f240e7c3042794ed56fe39558d80bda3fdf19b40d3180973

  • SHA512

    8d266b01a73ee1403e8f0ba143c9db609f1b89aacfd54eefad3768c8f475b505cb77c1f479a0b7518a5de665988fb655402067683e9d14b22c845ad5a61fab23

  • SSDEEP

    12288:9MrOy90stK+pfG8j/83Zp8vkZum6m3qKxl2qgaex6C7H1ixBWLhF9:Ly7K+pvr8/czm99l2qg7x57H1ixBU

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1