Extracted

• • Target

    4016428db29b3ffcfcc9c8b335311e6bc1fb4d4ef8613f3b4561d4be1c39bb58.exe

  • Size

    818KB

  • MD5

    c1b4a4020272197362c75de67db1a4d2

  • SHA1

    53a2651c4959c87f078016cd15edbe157813e9f4

  • SHA256

    4016428db29b3ffcfcc9c8b335311e6bc1fb4d4ef8613f3b4561d4be1c39bb58

  • SHA512

    3c3a5dc442b9603b70cc340ae62e6059fd265f65d4a103c049ce7fdcb3581c4a96e524669646a886793b8734bbf31fb8b91c61f587030f10d3479722ec9bb87c

  • SSDEEP

    12288:aMr3y90ZcrCqYt4x6fX9cIIu9bym6JLkSYDa/PZ0IDsfjx0oZNtIlGifo3PxUJ:tyBCptk2N3I0by3AW/iGsN0sdPyJ

  Score

  10^/10

  healerredlinedubkadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1