Extracted

• • Target

    bcafe392101a57f32629dfcdbafb57a1398c805384b2649df97bb563b84838fb

  • Size

    697KB

  • MD5

    e7b7747e380d08c6edc9afb3cd4a93f2

  • SHA1

    6f455a4e0058360598ad90711a3cdf43827bd8cc

  • SHA256

    bcafe392101a57f32629dfcdbafb57a1398c805384b2649df97bb563b84838fb

  • SHA512

    b80a185887717e07795908e28ac0736c20212317c1892856818a5f949473f356b94e1dd9190eac8e70c46683d297299b360e861d48c8395bd3ede66f348d89f9

  • SSDEEP

    12288:jMrJy90dVSltTiRUgKTd1EeOk0xbw49fR3uJAyWSHnY9g6CjiPHoT3/daJY:+yCSltTS0h1EeOXtCAyWSHEgRjiPHoTv

  Score

  10^/10

  healerredlineruzhpediscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1