healer | b7a97f5c651f69fd0a78d64d2cde21a85f2ac7f89754678241d0f1f043b20902 | Triage

Submit
Reports

Overview

overview

Static

static

3

b7a97f5c65...02.exe

windows10-2004-x64

Sharing

General

Target

b7a97f5c651f69fd0a78d64d2cde21a85f2ac7f89754678241d0f1f043b20902
Size

1.5MB
Sample

241110-3ntkasxelm
MD5

575e0df06e03f3aab8aff3842186e2fa
SHA1

678e144810f6c5f45f1043fa793d07861badf91d
SHA256

b7a97f5c651f69fd0a78d64d2cde21a85f2ac7f89754678241d0f1f043b20902
SHA512

61c3adcafc728fa474fc85d7ef995abb09e8d73aed8deee0d94e640db32b87e3815310984e33fbae159bc2590c0f42413ef15607b88e89ffef9746a7684c7040
SSDEEP

49152:bGluRiRXFE+7hZKKqTxGG/76Nn4NBgg2Eqq:ylykVQzTxGG+NeBgjvq

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b7a97f5c651f69fd0a78d64d2cde21a85f2ac7f89754678241d0f1f043b20902.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  b7a97f5c651f69fd0a78d64d2cde21a85f2ac7f89754678241d0f1f043b20902
- Size
  
  1.5MB
- MD5
  
  575e0df06e03f3aab8aff3842186e2fa
- SHA1
  
  678e144810f6c5f45f1043fa793d07861badf91d
- SHA256
  
  b7a97f5c651f69fd0a78d64d2cde21a85f2ac7f89754678241d0f1f043b20902
- SHA512
  
  61c3adcafc728fa474fc85d7ef995abb09e8d73aed8deee0d94e640db32b87e3815310984e33fbae159bc2590c0f42413ef15607b88e89ffef9746a7684c7040
- SSDEEP
  
  49152:bGluRiRXFE+7hZKKqTxGG/76Nn4NBgg2Eqq:ylykVQzTxGG+NeBgjvq
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy