Extracted

• • Target
    xdd90cdf1beb816e372cbfed148243628999c6ac62e2a0239c73093f321b0a31f.exe
  • Size 3.1MB
  • SHA256 dd90cdf1beb816e372cbfed148243628999c6ac62e2a0239c73093f321b0a31f
  • MD5 cbdadf7be4f0a628238f77f09bec37cf
  • SHA1 dbd8ca2f292c24e4d45c2f7c90784d00e516842d
  • SHA512 583db0657283f95b2424a68369f756778181d648f5dfe6f2453c7a7add74c67f62b6491275808ad4b198694f33fdcbbe6d1963300f7e31358a6c59d158e45e21
  • SSDEEP 49152:4EtNy31uZUbWeVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B:3N72bWJnLrHp/qKm2/Sb/
  • TLSH
    T11CE58B53EB915AD8E65D0936AF184150D72EF261AAEF2360342C520DCE93387BF61E3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  borisdefense_evasiondiscoverydropperevasionhealerredlineinfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2