Extracted

• • Target

    b313b9ef830df585eec2148a0811f0cba432e40bdb3b10798a9f3c47c7af4d35.exe

  • Size

    202KB

  • MD5

    48a6f1a59cfb13ac2fc958acc9224155

  • SHA1

    f83c70163ae3148a72e2a3aca8cbc1060742ab35

  • SHA256

    b313b9ef830df585eec2148a0811f0cba432e40bdb3b10798a9f3c47c7af4d35

  • SHA512

    16a0a25c387a7f31edd061b360a59107d51e3b868c4ab4e0d610daec81ecd3f58a6cb63a4c9938c0f1391514dadde887e57095faad82acb9a2b630e1779686be

  • SSDEEP

    3072:KVy+bnr+O115GWp1icKAArDZz4N9GhbkrNEk6YfA7jkFF9j5dBKOolY17:KVy+bnr+yp0yN90QEGfAHsF3Ld

  Score

  10^/10

  healerredlinefukiadefense_evasiondiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1