Extracted

• • Target
    8e7d6b99951f6df2396c7c73deb87bc422b4e4ca02b077774bdfc0171fadb81a.bin
  • Size 307KB
  • SHA256 8e7d6b99951f6df2396c7c73deb87bc422b4e4ca02b077774bdfc0171fadb81a
  • MD5 3cbc9f7b20ce6944883dd1c0cda041f8
  • SHA1 c48c9044aba6967d897dd2a4034a9c1e61c3ae40
  • SHA512 fe08a7882ba1643c0f8528e295dd217daf69567490b0e08fdaa7173dbfac002da2ee1972802c6fe7c981b8cb585aeaff40262a7cb13cd40866b6320a29a86138
  • SSDEEP 6144:KYy+bnr+lp0yN90QEO5F5OYc1u31g4TBywqNaRqD/dFSRIQn/ZE:MMrxy908xc1u31TTE0ujS7nu
  • TLSH
    T1BC64E113A7E54033E9F127B068FB12C30A35BCA29978A35B2785695A1C73684F57237F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  lulsadefense_evasiondiscoverydropperevasionhealerredlineinfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Family: Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral1