healer | d74f975cd6903aaf4b74d2630bf0bf46da6dfb442165e80dd954185c62a77547 | Triage

Submit
Reports

Overview

overview

Static

static

3

d74f975cd6...47.exe

windows10-2004-x64

Sharing

General

Target

d74f975cd6903aaf4b74d2630bf0bf46da6dfb442165e80dd954185c62a77547
Size

703KB
Sample

241110-3wr2fayald
MD5

235ac3e47d802bcf752f2e356ea09b33
SHA1

ee3ab3072c75a88a4ee109e26706795f9227bf2e
SHA256

d74f975cd6903aaf4b74d2630bf0bf46da6dfb442165e80dd954185c62a77547
SHA512

3ad1442958d6a1e1e7d27eddf93347184d6871572f6ffb6a88520e29e557c23f46c28ae19cea8efe639b3fd67ecb9c23470ef26bbb0c0ef49a6dcfdd7fdd543c
SSDEEP

12288:Zy909EYxs5ODbguW1u27XTPrd6NH5tRI1mzCYUIzqMpO/KZGuXF:ZyMEus5vL1u27XTPrd6vKOJUI+CfGu1

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

d74f975cd6903aaf4b74d2630bf0bf46da6dfb442165e80dd954185c62a77547.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  d74f975cd6903aaf4b74d2630bf0bf46da6dfb442165e80dd954185c62a77547
- Size
  
  703KB
- MD5
  
  235ac3e47d802bcf752f2e356ea09b33
- SHA1
  
  ee3ab3072c75a88a4ee109e26706795f9227bf2e
- SHA256
  
  d74f975cd6903aaf4b74d2630bf0bf46da6dfb442165e80dd954185c62a77547
- SHA512
  
  3ad1442958d6a1e1e7d27eddf93347184d6871572f6ffb6a88520e29e557c23f46c28ae19cea8efe639b3fd67ecb9c23470ef26bbb0c0ef49a6dcfdd7fdd543c
- SSDEEP
  
  12288:Zy909EYxs5ODbguW1u27XTPrd6NH5tRI1mzCYUIzqMpO/KZGuXF:ZyMEus5vL1u27XTPrd6vKOJUI+CfGu1
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy