healer | 9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158 | Triage

Submit
Reports

Overview

overview

Static

static

3

9171bf602e...58.exe

windows10-2004-x64

Sharing

General

Target

9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158
Size

944KB
Sample

241110-1r5evswfpg
MD5

565c0c2ee53c4aa6e314afd8961dc10f
SHA1

96f590c1abecaa9bcc5974aabfe5380bd7fb4e08
SHA256

9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158
SHA512

fc6ef39e26fd4101d75eb48bc972825fa46224a7692089b1634224fa7733cd93f4688751a73c0ff2701b6c4ea6f2f8c2015cec632600be8dc6d2dc2ad1b4ce29
SSDEEP

24576:RyTV59f+wWjmlNeMqWbeMr3nOBJ8Y1IR2mKQi6:ETV59f+l6+Mr3guGIR2mvi

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158
- Size
  
  944KB
- MD5
  
  565c0c2ee53c4aa6e314afd8961dc10f
- SHA1
  
  96f590c1abecaa9bcc5974aabfe5380bd7fb4e08
- SHA256
  
  9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158
- SHA512
  
  fc6ef39e26fd4101d75eb48bc972825fa46224a7692089b1634224fa7733cd93f4688751a73c0ff2701b6c4ea6f2f8c2015cec632600be8dc6d2dc2ad1b4ce29
- SSDEEP
  
  24576:RyTV59f+wWjmlNeMqWbeMr3nOBJ8Y1IR2mKQi6:ETV59f+l6+Mr3guGIR2mvi
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy