Extracted

• • Target

    d6c58df1b986a1e6f59a3d73a9afb47161e2b0330941f700300c8d027bf0a6e4.exe

  • Size

    655KB

  • MD5

    66ef33cc2d4763c962e6dc8b21112a12

  • SHA1

    1bf84e9732bd51ef4418512f40a3d93e611d204a

  • SHA256

    d6c58df1b986a1e6f59a3d73a9afb47161e2b0330941f700300c8d027bf0a6e4

  • SHA512

    923790382f2eb45b0fe984a444b9b579f337b7dbc764dc4714f949ab172f1158436b153e618af354dfffc8c11e167b807afd0e4e2500ed35591f2bd59c263561

  • SSDEEP

    12288:WMr3y902DwjtaxlmeqjZ2GyDWfngehn2Ck2gbn1iVzKfyL:dy99xlmXjGGgY2WgD1+zDL

  Score

  10^/10

  healerredlinerostodefense_evasiondiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1