Extracted

• • Target

    a38b6bb36099a0bd8d758afeb3703df39d8b2cad91f0b91670efbdb35cc658d4

  • Size

    642KB

  • MD5

    b1cac9a6c64a1e1bc1919d17ac0a913f

  • SHA1

    20dfbf7f78ab449c0aa023a1c09d6b98340f9533

  • SHA256

    a38b6bb36099a0bd8d758afeb3703df39d8b2cad91f0b91670efbdb35cc658d4

  • SHA512

    9779ce08b67dbf5966dc29646b5d0d6a1d54ef44fad16548cfe9e9510bfc9da1f4ebaa899c924b0b7fee655d79d310e051a5bd656c84d56d7fd301a08ae1bcb0

  • SSDEEP

    12288:JMrOy908L/VYRV/8oGztkDe+v0oxi3eL+nPNKo7:/ytDVWtGeDe+soxO9

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1