healer | 0ad768060c70d8d1e51fc1d968b61a1a3755455c8c2a6f813c061f7fa19323d6 | Triage

Submit
Reports

Overview

overview

Static

static

3

0ad768060c...d6.exe

windows10-2004-x64

Sharing

General

Target

0ad768060c70d8d1e51fc1d968b61a1a3755455c8c2a6f813c061f7fa19323d6
Size

1.0MB
Sample

241030-1wpj7stkcr
MD5

aff8b61b9cbfc22b8aa24d134701bc38
SHA1

6e23d0ce463e776d69cb1f244a5b7bdbd6345d32
SHA256

0ad768060c70d8d1e51fc1d968b61a1a3755455c8c2a6f813c061f7fa19323d6
SHA512

6bb5e655dbd51066bcfab7a474517e5ff15e55255910ec96543ab41f0b7e7a87ee83227d280a14e719ded22697b0b7cbc95ad664b290d7cca4426e885eb36866
SSDEEP

24576:dy+Kr1jRoM6Ubj3i4WX6BU8btDZEjTdRCLFf6:4fKM6UbMX6BU8bV6jTds

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0ad768060c70d8d1e51fc1d968b61a1a3755455c8c2a6f813c061f7fa19323d6.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  0ad768060c70d8d1e51fc1d968b61a1a3755455c8c2a6f813c061f7fa19323d6
- Size
  
  1.0MB
- MD5
  
  aff8b61b9cbfc22b8aa24d134701bc38
- SHA1
  
  6e23d0ce463e776d69cb1f244a5b7bdbd6345d32
- SHA256
  
  0ad768060c70d8d1e51fc1d968b61a1a3755455c8c2a6f813c061f7fa19323d6
- SHA512
  
  6bb5e655dbd51066bcfab7a474517e5ff15e55255910ec96543ab41f0b7e7a87ee83227d280a14e719ded22697b0b7cbc95ad664b290d7cca4426e885eb36866
- SSDEEP
  
  24576:dy+Kr1jRoM6Ubj3i4WX6BU8btDZEjTdRCLFf6:4fKM6UbMX6BU8bV6jTds
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2024

Terms | Privacy