Extracted

• • Target

    18610f0c5f8676474a4b2d84610ef53f043f12076ee2f7d35f4634987bf2943c.exe

  • Size

    536KB

  • MD5

    8152de5fa13af0eb869f91fdf88f3486

  • SHA1

    59bd30de444e154b71d3d7bf1f14a9e37d7ab153

  • SHA256

    18610f0c5f8676474a4b2d84610ef53f043f12076ee2f7d35f4634987bf2943c

  • SHA512

    e9e03d84edfa7fe33eae1faa3c321d1d364e8d52ea1441222091238c31e36f25a51cb8477dbafd6578ab15905cf2b095d0b13d64e3d71957d11668a335218860

  • SSDEEP

    12288:HMr7y90Xm9sHJVOoxyCPEfYiIG7Z89J7tg5pyF40N8:YyNaVOVCygupyel

  Score

  10^/10

  healerredlinerouchdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1