Extracted

• • Target

    b90b640b27f6f175293cd5ea87417ba317d06a79efdcda18e83e04c31dc15b86

  • Size

    561KB

  • MD5

    1ec65bb9de863d382dbf1d2e6d1fe05a

  • SHA1

    425b576f983b27ded4ce19c4b34d9e14356b2550

  • SHA256

    b90b640b27f6f175293cd5ea87417ba317d06a79efdcda18e83e04c31dc15b86

  • SHA512

    67025152a6bc0261c9b1ad086888632bae89bf8dbe0ed05da99e2b7e3f08dc2951d33f8dbe450132d47edcbd4785450c42016a931c5e9fb88f5f6698724e04ff

  • SSDEEP

    12288:TMrWy90mM8RyIUXddjQfVyCgMib2M+2aMCI2kmU0Vaad:pyJ3YIUX8fOMAU20Hkmbr

  Score

  10^/10

  healerredlineronamdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1