Extracted

• • Target

    0da1027d960c54d665fef9eb651d18420bc830296dd43a8469b65c500ed57e45.exe

  • Size

    594KB

  • MD5

    032d79225acbd1031400de9102874f7d

  • SHA1

    64e51beccb0d4db3341303cb8e59e1ad0a480043

  • SHA256

    0da1027d960c54d665fef9eb651d18420bc830296dd43a8469b65c500ed57e45

  • SHA512

    072687df6c3bde38eb90732cb878b2ff4989f9512911d8636a4e3329cb26e7b2bb3a8220e934765ead45a8f86bc64863dc949c00c4bc27bd6023f94db2d6b8c0

  • SSDEEP

    12288:Iy90w5Y4/A7f0FRqTzlWtQvNf236EVlbApMRg:Iyl6YFRqdqJ36EbNg

  Score

  10^/10

  healerredlinemazadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1