Extracted

• • Target

    d5e52815e5c72eb895b608a595389dccc15637549599f0fe2caa42a9cb7f2ae6N.exe

  • Size

    516KB

  • MD5

    695eae2f10828196fc46414b18653110

  • SHA1

    3e8b7cf84c510f272db2a6951a28a08e9f3ff7a8

  • SHA256

    d5e52815e5c72eb895b608a595389dccc15637549599f0fe2caa42a9cb7f2ae6

  • SHA512

    669987e322a21df48e659344b3e7829e3d0ac674e9019a6de5f13370581c3a01c8cd902235e93562b5130e9373e3da0311ffe9a637e39c57af23d9324fc321d5

  • SSDEEP

    12288:TMrMy90YIVZru66I5mBt16EZksHHEq5LuiZngEz:fyEVZ7HgcERLaEz

  Score

  10^/10

  healerredlinedubikdefense_evasiondiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1