healer | eb3240c78e866fdfe779080ec448aab72ad088350c645b4c4860b84a7f375a53 | Triage

Submit
Reports

Overview

overview

Static

static

3

eb3240c78e...53.exe

windows10-2004-x64

Sharing

General

Target

eb3240c78e866fdfe779080ec448aab72ad088350c645b4c4860b84a7f375a53
Size

745KB
Sample

241104-q6sphazmet
MD5

3346e36e97209a07004bed00f207ba64
SHA1

808527779da284b27e1f5ca32e94135f00606fe1
SHA256

eb3240c78e866fdfe779080ec448aab72ad088350c645b4c4860b84a7f375a53
SHA512

ddc6fb01a00856e32b4e5a4a55e6496484924ea7d18f386b282aa6682df70dba4fdf0c42dd97a8f66f5d705ddc394f70d25eef0fe8ada544f92c17f0abd66fc3
SSDEEP

12288:dy908a52znYZnl1ulJQIYYeO08yTbhrbckrhEX3qnXfSg5WXejzjnCKEIfe:dyw2znOulJQIYWctwkrOqnXfAInChI2

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

eb3240c78e866fdfe779080ec448aab72ad088350c645b4c4860b84a7f375a53.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  eb3240c78e866fdfe779080ec448aab72ad088350c645b4c4860b84a7f375a53
- Size
  
  745KB
- MD5
  
  3346e36e97209a07004bed00f207ba64
- SHA1
  
  808527779da284b27e1f5ca32e94135f00606fe1
- SHA256
  
  eb3240c78e866fdfe779080ec448aab72ad088350c645b4c4860b84a7f375a53
- SHA512
  
  ddc6fb01a00856e32b4e5a4a55e6496484924ea7d18f386b282aa6682df70dba4fdf0c42dd97a8f66f5d705ddc394f70d25eef0fe8ada544f92c17f0abd66fc3
- SSDEEP
  
  12288:dy908a52znYZnl1ulJQIYYeO08yTbhrbckrhEX3qnXfSg5WXejzjnCKEIfe:dyw2znOulJQIYWctwkrOqnXfAInChI2
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2024

Terms | Privacy