Extracted

• • Target

    38319b663b5660de73901f0f32d815e12c06ef70a8157c6683f3a9c16146578b

  • Size

    787KB

  • MD5

    0cdbee7e1a97bef1c66abfba4077c84c

  • SHA1

    fa370ff2d123f2926003a834b3e7247a438d9f43

  • SHA256

    38319b663b5660de73901f0f32d815e12c06ef70a8157c6683f3a9c16146578b

  • SHA512

    799bc89272a306e7f43680c489cf714b7cfe48e3fa88709775677382896603988a995f5b1de7fe8fd929979dcb2f607465106705bf1ffb56e2eeb22aac90a551

  • SSDEEP

    12288:9Mroy90sFs4/zzLr/w/r5sKykqnZpghad+Xjmnvpl1ghceW8g1mN8rAk18DZmrdt:JyU4XIDaKyXqY0TmnvplOK1crtCO6

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1