Extracted

• • Target

    69211bc04bbfceb8632f0492017f5539513fe3144530e43116a38172a85911c7N.exe

  • Size

    668KB

  • MD5

    eec0a7e648689dcfd30ec6ffbce57494

  • SHA1

    fba23f39619bb70a8a51ed94d380d06ecb2bfe7c

  • SHA256

    5b68b6c5c98f124eb2b3a6d712fada4efe60b1826631975493a9adaab6441648

  • SHA512

    1162a1814f8789d90733d1eaa8ef322cdb6800f03574c5ab0e7dc36ee86ea98a243d8fee88c0699452cfb6afe699f706e3223779721cb768261e46b9d6ad5ef3

  • SSDEEP

    12288:kMrBy90hLhwkslnczmdgLgvPK+03d+qDxWe+MeVuZsEd232F:Ny2LCltPK+0UqVl+78Zx9F

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1