Extracted

• • Target

    71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34

  • Size

    894KB

  • MD5

    278050dcb822319757b6b28f095ad40b

  • SHA1

    566468b46b8aa98679126a914ff81ddf19422f94

  • SHA256

    71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34

  • SHA512

    9f89459ed68cbb9a5639081760a06e03b17bd1012628fd2d8c4c25267cfdbc95ab8e15c133d215d338711c14381d802021f7d1b3fb83c84eae5647067ad30f1e

  • SSDEEP

    12288:EMrcy90z9c75HmMAgbu7INcogmtfe/Q4E9fEvNC2IV4Wr+Tps1xdOIXDZHFCp5de:oy3lHHAMXjiQlf+N1IGatjq/EBua

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1