Extracted

• • Target

    ceb562508fd2bae55702b80da9878fa9257dd56709abf9e4042ca53404bc226aN.exe

  • Size

    202KB

  • MD5

    db51cf337a85beb1a9393e44d3812820

  • SHA1

    d2ead72904c1a174134da190dcf39d4298cd69a9

  • SHA256

    ceb562508fd2bae55702b80da9878fa9257dd56709abf9e4042ca53404bc226a

  • SHA512

    e6fefbc52118b79ee0da81f662d5f5aaab041ead817a69a27f6a5e4819a138227f1ad0cb83a179db40f940a1e601447aa48389905c1b5303444066a99a5767c5

  • SSDEEP

    3072:Kry+bnr+O1S5GWp1icKAArDZz4N9GhbkrNEk6bYDk1NdGCHv68IBSnlYa:Kry+bnr+Jp0yN90QEJckbsSv6v

  Score

  10^/10

  healerredlinefumadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1