Extracted

• • Target

    48659c2b5a430d42f23e87ba1de60280bddef602aec9f9a2534a069bd5b8184a

  • Size

    529KB

  • MD5

    d118f94ddb3d4a2e49d21541686e963f

  • SHA1

    f2e603673bcc83dd182d1dac5d1f16b0611502d2

  • SHA256

    48659c2b5a430d42f23e87ba1de60280bddef602aec9f9a2534a069bd5b8184a

  • SHA512

    9dc8f573392933bf13fcfd97cd8b8157e235d0f9683386b25bcbb5d04f9227b85707032bb5c079f4474ec23567b8fe2810a2378954d66a5721d31029f74d7a35

  • SSDEEP

    12288:sMray90wtQi05WaY0OPMFc35rI7OehOj1Ow8rarKVRP:uyjt6I7MFyLIOj1Luj

  Score

  10^/10

  healerredlinerosndiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1