Extracted

• • Target

    fe0a9db8b4ea0ef9ea1024a6a14d97adf17c1fb355eddeaa37809d5c50cb7d50

  • Size

    538KB

  • MD5

    c020f2b5b15d2d54b7465d24ff0cf430

  • SHA1

    94416bdc1e2272a79b78fe383aade2ad3a94dac0

  • SHA256

    fe0a9db8b4ea0ef9ea1024a6a14d97adf17c1fb355eddeaa37809d5c50cb7d50

  • SHA512

    d1992aeb5e846d8eff47f41c04d6b4b49370a24da707d63a2d83cd63f2cbd7abea7a0f50190b5d0e8d765fac428af66242894f9fded893b908c3656156e0ba06

  • SSDEEP

    12288:SMr7y90iMjsVuE9Q5cdvPC1Z3dsgydt3PzfKUSAza92qnBM6U:hyWoVxQ5uvPC1dHydt3eoz+9U

  Score

  10^/10

  healerredlinefukiadefense_evasiondiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1