Extracted

• • Target

    5e38f0bf5e990a01a3d000599767a72555dbe2cefaa8131423480edf539a151aN.exe

  • Size

    666KB

  • MD5

    697bc8adb11b2ac8ebcd4838dc9eb380

  • SHA1

    64dfe94319b2de1984fdf23a3fa08d386caf3593

  • SHA256

    5e38f0bf5e990a01a3d000599767a72555dbe2cefaa8131423480edf539a151a

  • SHA512

    84351d8f32d134ad8136c28958bfe81259b5f85c9752d0aa30900be93a0b6640429941ef224688d42768f247ee669c224ccc01f6d6e2cda98cbd36edfaee0449

  • SSDEEP

    12288:+MrWy90c+Lx/yr1/1ZcjdWpNu9dDhTTwwgGYaEYQlaLMz9pzwOFVx:0ypWUgzFTTwwgGYaZjL4z1J

  Score

  10^/10

  healerredlinerosndefense_evasiondiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1