Extracted

• • Target

    aab961c5af17078dfaa5f8ea1e2928b7a6f25aef97a6b3b6e6d59e51556176c7.exe

  • Size

    667KB

  • MD5

    99385c6419e7ca9997f128945a742bfa

  • SHA1

    3ecbb556fdf0c41d87f42fcbe03fc53751ce7ba9

  • SHA256

    aab961c5af17078dfaa5f8ea1e2928b7a6f25aef97a6b3b6e6d59e51556176c7

  • SHA512

    8952fe17c7255a7adf4c4862ad02359fb9a81c64a6007fd893268d4eced4af5f026e335b6f72204cf530f0a8f0d82fe3a081645880d05b88817c6069673e2f16

  • SSDEEP

    12288:/MrXy90y7rqV0hfUzmd6LgvPK+035SVemCxWe+MeVuRs0dVYs7Z:oylA0xbPK+04Vejl+78RZrT7Z

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1