Extracted

• • Target

    3549f5aeeeb79ca27033813c6850a8808ff65db2ccddfeb0cb3e0998acce87ccN

  • Size

    667KB

  • MD5

    f7312033c4f64db37b6de9d0cd979870

  • SHA1

    9ab27e5fa070e0e86bb0b167cb76d52663630d28

  • SHA256

    3549f5aeeeb79ca27033813c6850a8808ff65db2ccddfeb0cb3e0998acce87cc

  • SHA512

    d2637b3e23545ea1c645e3a3fa22ee1c444d5c208ec6d8d23538dd5588165c2d99cb1b52d1371bcbda836833533c4bd34e566738bb6dea944b9b6e0e14bcd32b

  • SSDEEP

    12288:/MrXy90y7rqV0hfUzmd6LgvPK+035SVemCxWe+MeVuRs0dVYs7:oylA0xbPK+04Vejl+78RZrT7

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1