Extracted

• • Target

    49d28f6a78dafc0cf97acf2407eeb67f3de3fce03f8a7c99cee5aacc39e8bbd3.exe

  • Size

    540KB

  • MD5

    12fd1f49d379a14f7cbfc5acbe55a98f

  • SHA1

    850bd3a905ce83377bdac00989292d7f5478dd72

  • SHA256

    49d28f6a78dafc0cf97acf2407eeb67f3de3fce03f8a7c99cee5aacc39e8bbd3

  • SHA512

    686f3b766282a2e9a0cb06fd89f56c2b67168add3c5f7fd4acae28da55dad1708ab0d0ad4bf5d708b36dcfcda7e093a4043337e6072aab612dff6e168f246deb

  • SSDEEP

    12288:KMrMy90i1dznwt0apd7GYl8kXBjWLPXLCcLl84qdcqbi:ayVdzwf3GYl8SKLLFl84qdcqbi

  Score

  10^/10

  healerredlinesonydiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1