Extracted

Extracted

• • Target

    0b5881f41278a89efd6ab112fc3d6e7001daef8286f28e9f4d01cf385ba239d6

  • Size

    551KB

  • MD5

    b092d831361de3ad03f3f391d5cad0da

  • SHA1

    0e49ef4d49130d3c27b15e0cb189dda967f40676

  • SHA256

    0b5881f41278a89efd6ab112fc3d6e7001daef8286f28e9f4d01cf385ba239d6

  • SHA512

    2dfd54eba74ec0d638a96b1836db7a2123db66d7bf3095f6102dbe485b8bc4beab8ddf53c417888a631ddfb3e33e5f532cd753a247dae75b8d95094d8750496d

  • SSDEEP

    12288:uMrry90tirqt6m6AL12lelXuAaiRdDIEu/VmQn/b1c/:hykiS6I5XuA5ZonD1c/

  Score

  10^/10

  healerredlinedezikmangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1