Extracted

• • Target

    866cbfb1903c072cf06e77e5ed86e85ccf39ffc970eca5473a7fdd517a06c096

  • Size

    550KB

  • MD5

    475eaf4f10c08cb66e770003a014cea5

  • SHA1

    dd23752f27acd73fa9a4f872aa45131e762d1e05

  • SHA256

    866cbfb1903c072cf06e77e5ed86e85ccf39ffc970eca5473a7fdd517a06c096

  • SHA512

    37837476e19c178045c11eefeb4ae3858b8579f1ac96417c8d284314cf85a6fa40a4453ebc2d3ff1f8e1c868a819d7fafbc9debedfac4b16f5c613edf03c9464

  • SSDEEP

    12288:YMrly90Eta6V3NgMm/K1E1YVy5PMaOJxuuv/:9ypjV3LgK1vy5suuv/

  Score

  10^/10

  healerredlinefuddiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1