healer | c030ac97c52634be25da2d9a35c57a593426710db88b369dc0cc959dd55ab191 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c030ac97c52634be25da2d9a35c57a593426710db88b369dc0cc959dd55ab191
Size

913KB
Sample

230825-ayke6ahh8w
MD5

20d6599a4108edff475478cdbb948430
SHA1

0c90fdf88cec0be3c8411a57c9933069fd30d1a1
SHA256

c030ac97c52634be25da2d9a35c57a593426710db88b369dc0cc959dd55ab191
SHA512

747468ef0b940db76ea0b52b95c1bd209c96b80b48fa8393c8c633fbb9bac679b77c6f31300d0351ded2da6ded784167fb1b735458b4956168d2a74d8e3ea7b8
SSDEEP

12288:6MrXy90LHAMviUzX3ccYJZMPdHYpQQJhPUJcuAvT6MreQ4u2KsPwhEqPWqGSyLEo:JyITfPYoUQKUc5T6MyQotYVWqjW5

Score

10^/10

healer redline vaga dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

vaga

C2

77.91.124.73:19071

Attributes

auth_value
393905212ded984248e8e000e612d4fe

Targets

- Target
  
  c030ac97c52634be25da2d9a35c57a593426710db88b369dc0cc959dd55ab191
- Size
  
  913KB
- MD5
  
  20d6599a4108edff475478cdbb948430
- SHA1
  
  0c90fdf88cec0be3c8411a57c9933069fd30d1a1
- SHA256
  
  c030ac97c52634be25da2d9a35c57a593426710db88b369dc0cc959dd55ab191
- SHA512
  
  747468ef0b940db76ea0b52b95c1bd209c96b80b48fa8393c8c633fbb9bac679b77c6f31300d0351ded2da6ded784167fb1b735458b4956168d2a74d8e3ea7b8
- SSDEEP
  
  12288:6MrXy90LHAMviUzX3ccYJZMPdHYpQQJhPUJcuAvT6MreQ4u2KsPwhEqPWqGSyLEo:JyITfPYoUQKUc5T6MyQotYVWqjW5
Score

10^/10

healer redline vaga dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinevagadropperevasioninfostealerpersistencetrojan