Extracted

• • Target

    000a5a12a332adc466790d9fcaa0987d23b1a4ed9411eaac47f01607db2476a4N.exe

  • Size

    415KB

  • MD5

    f882639404a4de9460630788068c596f

  • SHA1

    7f6e6021b8b7138b72a80f1e5fa255a71211f311

  • SHA256

    bf38ba0e12f5776c7a8f0241bf4aa4d03e54f09dc1711d68a575b19f8f96fd5f

  • SHA512

    232ad5b6626af47c4ac86c5427745b0fe67366e0459ca28b630a136bebff5c0f90aa209fa2a5a7300069151c66dc64b2d140dd90f822b643f3fb40a280b634d6

  • SSDEEP

    6144:KVy+bnr+sp0yN90QEAhoJ7I7mw6LGBhca6G2nHX6WL4oocTygsS7RtI726:nMrUy90GhoJc7mw6LGBhc1G8zFyw76

  Score

  10^/10

  healerredlineronamdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1