healer | a845129a2bc1f81adf1408e7122c216a6966d6f486d069d0fa8d8d98fcca97a2 | Triage

Submit
Reports

Overview

overview

Static

static

3

a845129a2b...a2.exe

windows7-x64

a845129a2b...a2.exe

windows10-2004-x64

Sharing

General

Target

a845129a2bc1f81adf1408e7122c216a6966d6f486d069d0fa8d8d98fcca97a2
Size

1000KB
Sample

241104-qv56fs1brl
MD5

a68dd4c1e87b106acb490aab38955c5e
SHA1

1ddc611c08f32ecb3a00bce967a8f4265f896698
SHA256

a845129a2bc1f81adf1408e7122c216a6966d6f486d069d0fa8d8d98fcca97a2
SHA512

0db784dc1ef562bcd81cb2f3cfd6203b18119e24d1062f8bc23efc54ab09292adc29daa5a01e02c3e04669f940a9354b6d4dceace6e8a0ca0987e697ad036fd2
SSDEEP

24576:ITLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:ervFqYjbfJV+QvCoyZzt9p

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a845129a2bc1f81adf1408e7122c216a6966d6f486d069d0fa8d8d98fcca97a2.exe

Resource

win7-20240708-en

healer redline discovery dropper evasion infostealer persistence trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

a845129a2bc1f81adf1408e7122c216a6966d6f486d069d0fa8d8d98fcca97a2.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  a845129a2bc1f81adf1408e7122c216a6966d6f486d069d0fa8d8d98fcca97a2
- Size
  
  1000KB
- MD5
  
  a68dd4c1e87b106acb490aab38955c5e
- SHA1
  
  1ddc611c08f32ecb3a00bce967a8f4265f896698
- SHA256
  
  a845129a2bc1f81adf1408e7122c216a6966d6f486d069d0fa8d8d98fcca97a2
- SHA512
  
  0db784dc1ef562bcd81cb2f3cfd6203b18119e24d1062f8bc23efc54ab09292adc29daa5a01e02c3e04669f940a9354b6d4dceace6e8a0ca0987e697ad036fd2
- SSDEEP
  
  24576:ITLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:ervFqYjbfJV+QvCoyZzt9p
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

behavioral2

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2024

Terms | Privacy