Extracted

• • Target
    f398b3fe08f6736060679513f0f623afff9975f71440dc9e1b02ba80e9f29ea3.bin
  • Size 307KB
  • SHA256 f398b3fe08f6736060679513f0f623afff9975f71440dc9e1b02ba80e9f29ea3
  • MD5 897345d6fb167228d1f1f374f512017d
  • SHA1 d52385d02e8952d5820f86a03ecd1f8e971d788f
  • SHA512 11e9501d33fe73755eb31eda0d5dad47f915f6e7826bb5295007cfe47d2af7e4cbea439a55ba2fd636e019f735b555fcfc93d478765a239693a7b1f8ccabc016
  • SSDEEP 6144:Kcy+bnr++p0yN90QEn5F5OYc1u31g4TByxhPAfwNQt3Fe9VDVvx:EMrqy90zxc1u31TTEkYmp89ZVvx
  • TLSH
    T17964F123E7D84033E4B61BB458FA03C31B35BCA29878936B27495D9A5C725C0A97637F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  diwerdefense_evasiondiscoverydropperevasionhealerredlineinfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Family: Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral1