Extracted

• • Target

    ba1dcd28468ff4c6f5167d07696adb52870c66bc9bdab982341077001647a558N.exe

  • Size

    648KB

  • MD5

    1cd2da428819fce6f2715d2102fb61e0

  • SHA1

    1f72abdf9c110398050d74df743e9ac3440f865a

  • SHA256

    ba1dcd28468ff4c6f5167d07696adb52870c66bc9bdab982341077001647a558

  • SHA512

    e543b70bb77ba76731add6e3f550e1e5988f9b1390d563e85d5eecbcc9e6af45a5f409b8dca40dd51d5b97326fd86f9bc5cdb46354eba54319e51e31fad0262c

  • SSDEEP

    12288:UMr8y90QzdmW46kVQ5DPhsESy3cR/CmuoLQhfovylvlCHZJ1zW040cEWEB:Ayv0DVQ5rhor/CHIS1vlcZZcEWEB

  Score

  10^/10

  healerredlinemangodiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1