healer | 3dc34e9881e6cbdb772351fb0c4efe793b21e8d2c2f2891c66a3fc154d664014 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

3dc34e9881...14.exe

windows10-2004-x64

Sharing

General

Target

3dc34e9881e6cbdb772351fb0c4efe793b21e8d2c2f2891c66a3fc154d664014
Size

470KB
Sample

241110-mvsnksvkdy
MD5

d0ea9bf585f1a9135fc20394676aa0fc
SHA1

66c82249048585198bed2ea310a7c56e4eb8f26d
SHA256

3dc34e9881e6cbdb772351fb0c4efe793b21e8d2c2f2891c66a3fc154d664014
SHA512

943e0da4bd18e4bda3f5b285d66d41d22581bccfc6f6f693ff60d80c23f08e1c2377eb9af0ba2cc63cc03b47abb6167c351607cc2de3a7d6ee5eaceb03e65310
SSDEEP

6144:Kdy+bnr+Fp0yN90QEIKmwpiV39OzbzinfVzCQFsmDSStilhhEEHur9mwafuVVXJm:TMrly90i5wpix0uFnC4SSkQ9JVVXgY6

Score

10^/10

healer redline fukia discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

3dc34e9881e6cbdb772351fb0c4efe793b21e8d2c2f2891c66a3fc154d664014.exe

Resource

win10v2004-20241007-en

healer redline fukia discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes

auth_value
e5783636fbd9e4f0cf9a017bce02e67e

Targets

- Target
  
  3dc34e9881e6cbdb772351fb0c4efe793b21e8d2c2f2891c66a3fc154d664014
- Size
  
  470KB
- MD5
  
  d0ea9bf585f1a9135fc20394676aa0fc
- SHA1
  
  66c82249048585198bed2ea310a7c56e4eb8f26d
- SHA256
  
  3dc34e9881e6cbdb772351fb0c4efe793b21e8d2c2f2891c66a3fc154d664014
- SHA512
  
  943e0da4bd18e4bda3f5b285d66d41d22581bccfc6f6f693ff60d80c23f08e1c2377eb9af0ba2cc63cc03b47abb6167c351607cc2de3a7d6ee5eaceb03e65310
- SSDEEP
  
  6144:Kdy+bnr+Fp0yN90QEIKmwpiV39OzbzinfVzCQFsmDSStilhhEEHur9mwafuVVXJm:TMrly90i5wpix0uFnC4SSkQ9JVVXgY6
Score

10^/10

healer redline fukia discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinefukiadiscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.