Extracted

• • Target

    afc7fb767aa27e8db1d8648b4a08cdd7cc0c8078bb2cc1ff983dd754116c1a68

  • Size

    479KB

  • MD5

    b41e5631df84af8b96a3241fbf98ae19

  • SHA1

    267ba75c3cc34575b218b7ce0e36c2a048b71ae4

  • SHA256

    afc7fb767aa27e8db1d8648b4a08cdd7cc0c8078bb2cc1ff983dd754116c1a68

  • SHA512

    13fbf49dc267cecfe1a57c9c1bbf6690014a4c71a034e09f4617423388c7fee7db34e22318d8a2afe4f6adc123c3dcfc90dc455736af6dfe0babe5c6a340497b

  • SSDEEP

    12288:vMrzy90HNeGxaZZhoKYYWo5bpCfO1ZcopQlSk:8yKAZX1z1mopQlJ

  Score

  10^/10

  healerredlinemaherdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1