healer | 0305d2b6c0e5a97563a4c1099f4e6af9452bc102c37b5c9418f88da8991c5f64 | Triage

Resubmissions

20-08-2024 16:20

240820-ts5npa1hlg 10

20-08-2024 15:13

240820-slvpgayepd 10

Sharing

General

Target

a1e5b6abdfff86723f005da754eef040N.exe
Size

722KB
Sample

240820-ts5npa1hlg
MD5

a1e5b6abdfff86723f005da754eef040
SHA1

3e011e66fc70160342ec11cb33228965cb6463b1
SHA256

0305d2b6c0e5a97563a4c1099f4e6af9452bc102c37b5c9418f88da8991c5f64
SHA512

b3f069c1716f0480ccf3e20f14dd9fdeca629c630a5de75f91de29f5a9b7068937a8fe8dd7dae6ad78ab7029507a2b4687291b448554a9114079972cd06aeec3
SSDEEP

12288:6MrVy90RmQZAZq88kMXB03V+t0mU9aseTa8ADQoVO4s0e9t5VItDvHQcQawuKWBV:3yDbLMR2cRsUrore75yNvHVHBV

Score

10^/10

healer mystic redline rota discovery dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rota

C2

77.91.124.73:19071

Attributes

auth_value
320c7daa59eb9b82e20a15162392a756

Targets

- Target
  
  a1e5b6abdfff86723f005da754eef040N.exe
- Size
  
  722KB
- MD5
  
  a1e5b6abdfff86723f005da754eef040
- SHA1
  
  3e011e66fc70160342ec11cb33228965cb6463b1
- SHA256
  
  0305d2b6c0e5a97563a4c1099f4e6af9452bc102c37b5c9418f88da8991c5f64
- SHA512
  
  b3f069c1716f0480ccf3e20f14dd9fdeca629c630a5de75f91de29f5a9b7068937a8fe8dd7dae6ad78ab7029507a2b4687291b448554a9114079972cd06aeec3
- SSDEEP
  
  12288:6MrVy90RmQZAZq88kMXB03V+t0mU9aseTa8ADQoVO4s0e9t5VItDvHQcQawuKWBV:3yDbLMR2cRsUrore75yNvHVHBV
Score

10^/10

healer mystic redline rota discovery dropper evasion infostealer persistence stealer trojan
- Detect Mystic stealer payload
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

healermysticredlinerotadiscoverydropperevasioninfostealerpersistencestealertrojan