Extracted

Extracted

• • Target

    1f8f2e95d6f85e33cc296e2b7176851bca9c1aa3b54ce642db91edb9844c7eb1

  • Size

    551KB

  • MD5

    555199ad434506ce0f8f21ebe69c8868

  • SHA1

    cc723560c3f9b6624ba44429d5c3817485f62a60

  • SHA256

    1f8f2e95d6f85e33cc296e2b7176851bca9c1aa3b54ce642db91edb9844c7eb1

  • SHA512

    f7a42ec464301b516dc4b26044e0ddfa3045610057739c80b4a2f208f9086a5d9aa7e9811eca7b9d4fbf62011d7f4b44f2f03b0af061cdd72c6d5c80d1185d60

  • SSDEEP

    12288:8Mrby90QWvWeLZBfLx73QS9qCAaiRdD1Ed/Vmpn4J8p56b+tH:XyLyBzW8A5iSn4JWU+Z

  Score

  10^/10

  healerredlinedezikmangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1