Extracted

• • Target

    c978efb94f72cf45e367cd39e47a220adf99af796e2c3e1434faadd2fc460197N.exe

  • Size

    694KB

  • MD5

    ceca9704ae89c299b8fd038bead29850

  • SHA1

    efd267d3032e3f744eaa28f9bee4fb356bd0eff0

  • SHA256

    c978efb94f72cf45e367cd39e47a220adf99af796e2c3e1434faadd2fc460197

  • SHA512

    6dd51a25c9c4e5d9a032629b4123f3555215200d8c26ed3f1b20e17232ddd5a6973143b1788242f062ec3aae783114927701f4e74e1e378e3e22c987d711ad08

  • SSDEEP

    12288:QMrNy908KTwehHG/nhNJNkSQqLYUAP8qT+5fnF+8gtffTI4Vy++ixhmKNm/L:NyVKEOG/hTkU8puY8gtffUdnixtYD

  Score

  10^/10

  healerredlinegenadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1