Extracted

• • Target

    b3fd93cdbb22498647bba224764a189c19d0d3226b63347e2fc10f7f8994facc.exe

  • Size

    992KB

  • MD5

    cedd2a204e4f2b1d19882d8800bad11b

  • SHA1

    215e0d5275d567f4c1599364f6e5f5ab0e726cc8

  • SHA256

    b3fd93cdbb22498647bba224764a189c19d0d3226b63347e2fc10f7f8994facc

  • SHA512

    383374e1864e6008a0945afb5ba1c2b45240efd0f3e476416ad7a7fef8cac2eccf8d1017cff94aeb44b38fb365231b2e979cb3d59612c37b91f3be7d74b055dc

  • SSDEEP

    24576:9yUtvrjcPD0GbgWSAg+Feg7Q+Yu2KsxUnWht0l:YUtTjcPDyWSAgKegbvLPWha

  Score

  10^/10

  healerredlinemixerdiscoverydropperinfostealerpersistence

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1