healer | 3e4d79dc7cb8a9e45d3bc2d3b2341da4bb619753324e1f0c78d52c2bf6f1aabc | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

3e4d79dc7c...bc.exe

windows10-2004-x64

Sharing

General

Target

3e4d79dc7cb8a9e45d3bc2d3b2341da4bb619753324e1f0c78d52c2bf6f1aabc
Size

484KB
Sample

241107-ntpe7s1hrn
MD5

d34c8daec0857501415d1d5c1226dd33
SHA1

ebe5f0a615efb5ef3787324539a289571e52344e
SHA256

3e4d79dc7cb8a9e45d3bc2d3b2341da4bb619753324e1f0c78d52c2bf6f1aabc
SHA512

fad88abf636e1370ca801dcfd9f707e1e9d91e8b6a325ec7dca62c15d8b2fc1dcf8b452dac971ee893c519365a8fba8762a9af31fc752e71f32be5eabffcca43
SSDEEP

12288:WMrsy90Fixx+UxocCDL02Kgr4wsjDMIP65:Oy/FudLqY4lMIP65

Score

10^/10

healer redline fukia discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

3e4d79dc7cb8a9e45d3bc2d3b2341da4bb619753324e1f0c78d52c2bf6f1aabc.exe

Resource

win10v2004-20241007-en

healer redline fukia discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes

auth_value
e5783636fbd9e4f0cf9a017bce02e67e

Targets

- Target
  
  3e4d79dc7cb8a9e45d3bc2d3b2341da4bb619753324e1f0c78d52c2bf6f1aabc
- Size
  
  484KB
- MD5
  
  d34c8daec0857501415d1d5c1226dd33
- SHA1
  
  ebe5f0a615efb5ef3787324539a289571e52344e
- SHA256
  
  3e4d79dc7cb8a9e45d3bc2d3b2341da4bb619753324e1f0c78d52c2bf6f1aabc
- SHA512
  
  fad88abf636e1370ca801dcfd9f707e1e9d91e8b6a325ec7dca62c15d8b2fc1dcf8b452dac971ee893c519365a8fba8762a9af31fc752e71f32be5eabffcca43
- SSDEEP
  
  12288:WMrsy90Fixx+UxocCDL02Kgr4wsjDMIP65:Oy/FudLqY4lMIP65
Score

10^/10

healer redline fukia discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinefukiadiscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.