Extracted

• • Target

    45459a7248cbe4e2a37efcd23aa999a2f00f7f0cf1b1fd74abe8bcc5b5a506e8

  • Size

    556KB

  • MD5

    0f3096caf53b613cb3f01969d7971950

  • SHA1

    8b5131616d804df38c6f6b4e54fd349dea250f7b

  • SHA256

    45459a7248cbe4e2a37efcd23aa999a2f00f7f0cf1b1fd74abe8bcc5b5a506e8

  • SHA512

    929bc392e16d2718d199d19d2563da6e0b4d9381863f584850506556d3a6c241d24b0041db31e6325fac39cd373a27a6b7ea65de2d018133edd5f5973c989486

  • SSDEEP

    12288:gMrHy90wLa7DOwwV92goOkfkh+22HzKoXYpd+dLTfn:3yrYOB2gZMpTm+dLjn

  Score

  10^/10

  healerredlineruzhpediscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1