healer | 022f941d323dc4ecf458821fddfe0988c8d0f0d0207ba5d36a54e6eaa47c4d02 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

022f941d32...02.exe

windows10-2004-x64

Sharing

General

Target

022f941d323dc4ecf458821fddfe0988c8d0f0d0207ba5d36a54e6eaa47c4d02
Size

481KB
Sample

241109-vc2sja1lfr
MD5

9d0cb0fc533d126b70e64244c76a55b3
SHA1

af5c81cf35f24271750ab7e56fdb6f5e4ae39df2
SHA256

022f941d323dc4ecf458821fddfe0988c8d0f0d0207ba5d36a54e6eaa47c4d02
SHA512

d0902be646c57ca5b60a660fc9484e0da9aec5c125ea0b587eab5bd2f37d44d8190a693d58f40b2fdb523a8b446deda4205cdad3789c5bd4cb5aa304ca03a3ab
SSDEEP

12288:NMrRy90gOIYEV1o5M+rPaCSNjSNO4sJBZJA:sykIJVKq+zSNe0JA

Score

10^/10

healer redline fukia discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

022f941d323dc4ecf458821fddfe0988c8d0f0d0207ba5d36a54e6eaa47c4d02.exe

Resource

win10v2004-20241007-en

healer redline fukia discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes

auth_value
e5783636fbd9e4f0cf9a017bce02e67e

Targets

- Target
  
  022f941d323dc4ecf458821fddfe0988c8d0f0d0207ba5d36a54e6eaa47c4d02
- Size
  
  481KB
- MD5
  
  9d0cb0fc533d126b70e64244c76a55b3
- SHA1
  
  af5c81cf35f24271750ab7e56fdb6f5e4ae39df2
- SHA256
  
  022f941d323dc4ecf458821fddfe0988c8d0f0d0207ba5d36a54e6eaa47c4d02
- SHA512
  
  d0902be646c57ca5b60a660fc9484e0da9aec5c125ea0b587eab5bd2f37d44d8190a693d58f40b2fdb523a8b446deda4205cdad3789c5bd4cb5aa304ca03a3ab
- SSDEEP
  
  12288:NMrRy90gOIYEV1o5M+rPaCSNjSNO4sJBZJA:sykIJVKq+zSNe0JA
Score

10^/10

healer redline fukia discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinefukiadiscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.