healer | 21d0424a130446325a54c1d1ebb06f55f1342d911554ef5d56a5d490d4b3acbe | Triage

Sharing

General

Target

21d0424a130446325a54c1d1ebb06f55f1342d911554ef5d56a5d490d4b3acbe
Size

527KB
Sample

231103-epvlzsdg67
MD5

a3d6afc43a4d86712ffe2aa629160fb9
SHA1

561484ebca46ed027eea54a73d07495ecda444e3
SHA256

21d0424a130446325a54c1d1ebb06f55f1342d911554ef5d56a5d490d4b3acbe
SHA512

eacb347f07ad989f9329ea4b7c69fdf6ac585b94dc815b0f233389e5ea940f43dd179fec0ed43a9bd2685d7cb80a3345db3a6fa9f6c96e1c6c35daf7b2253891
SSDEEP

12288:rMrZy90zvE6M60ko89xfzw+fvv2SYwM/7M55ht/Q4g:ay0t5o8Tw+fv9YwmghQz

Score

10^/10

healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

C2

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Targets

- Target
  
  21d0424a130446325a54c1d1ebb06f55f1342d911554ef5d56a5d490d4b3acbe
- Size
  
  527KB
- MD5
  
  a3d6afc43a4d86712ffe2aa629160fb9
- SHA1
  
  561484ebca46ed027eea54a73d07495ecda444e3
- SHA256
  
  21d0424a130446325a54c1d1ebb06f55f1342d911554ef5d56a5d490d4b3acbe
- SHA512
  
  eacb347f07ad989f9329ea4b7c69fdf6ac585b94dc815b0f233389e5ea940f43dd179fec0ed43a9bd2685d7cb80a3345db3a6fa9f6c96e1c6c35daf7b2253891
- SSDEEP
  
  12288:rMrZy90zvE6M60ko89xfzw+fvv2SYwM/7M55ht/Q4g:ay0t5o8Tw+fv9YwmghQz
Score

10^/10

healer mystic redline gruha dropper evasion infostealer persistence stealer trojan
- Detect Mystic stealer payload
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

healermysticredlinegruhadropperevasioninfostealerpersistencestealertrojan