healer | 5e2e7772e09b99431a0d7eb7bd29cf5a8ef3a2adaa5c516369b8138d8bf5633f | Triage

Submit
Reports

Overview

overview

Static

static

3

5e2e7772e0...3f.exe

windows10-2004-x64

Sharing

General

Target

5e2e7772e09b99431a0d7eb7bd29cf5a8ef3a2adaa5c516369b8138d8bf5633f
Size

480KB
Sample

241110-1nmewaweqd
MD5

546b06204fe2d4787f6dd9d09e821d86
SHA1

fc26c671dad2d0dd1a905cef62b12debbfacc3e3
SHA256

5e2e7772e09b99431a0d7eb7bd29cf5a8ef3a2adaa5c516369b8138d8bf5633f
SHA512

6c2807c9df5868a0dc7b0ddc3488efb10de4728e7d85ed893e8c453a1355df8e6b7c74d492e49d47b2f8ef353c9a9337af377a587e4c7f8141c3d21719bcc009
SSDEEP

12288:+MrBy90cw5m7cGx0YvHJN+vyUXW3v8SfzM:Py8mzx0mHJ4vxXOv8b

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

5e2e7772e09b99431a0d7eb7bd29cf5a8ef3a2adaa5c516369b8138d8bf5633f.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  5e2e7772e09b99431a0d7eb7bd29cf5a8ef3a2adaa5c516369b8138d8bf5633f
- Size
  
  480KB
- MD5
  
  546b06204fe2d4787f6dd9d09e821d86
- SHA1
  
  fc26c671dad2d0dd1a905cef62b12debbfacc3e3
- SHA256
  
  5e2e7772e09b99431a0d7eb7bd29cf5a8ef3a2adaa5c516369b8138d8bf5633f
- SHA512
  
  6c2807c9df5868a0dc7b0ddc3488efb10de4728e7d85ed893e8c453a1355df8e6b7c74d492e49d47b2f8ef353c9a9337af377a587e4c7f8141c3d21719bcc009
- SSDEEP
  
  12288:+MrBy90cw5m7cGx0YvHJN+vyUXW3v8SfzM:Py8mzx0mHJ4vxXOv8b
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy