Extracted

• • Target

    5c2430e57b2190b99b9fe77eefe6e356fb39bcfe6ed8fd301fd4ae26550c8433

  • Size

    555KB

  • MD5

    525824ece785f0bb34e902b1386bfa61

  • SHA1

    eceb4d9b9e67f22f586bb37a4789137dda381d70

  • SHA256

    5c2430e57b2190b99b9fe77eefe6e356fb39bcfe6ed8fd301fd4ae26550c8433

  • SHA512

    1ed935c4f4ee08e278b4958ed80ba444a789ae769cd657225f24ce24f9db1f6351f69caab49029fd814be0850078a2410604b88c70c64b76c32edf5927ba5d8e

  • SSDEEP

    12288:BMrGy90RyLeTkr6YUa8Cn9XzIBDhIFuWFycuyO+uFwX:Hy+Wr6YUX+zIlhIAW+Ju

  Score

  10^/10

  healerredlineborisdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1