healer | 5f86b62d6d98cd4cb541a26e452f982c97efe11346e2e8f7a06be99e28d4173e | Triage

Submit
Reports

Overview

overview

Static

static

3

5f86b62d6d...3e.exe

windows10-2004-x64

Sharing

General

Target

5f86b62d6d98cd4cb541a26e452f982c97efe11346e2e8f7a06be99e28d4173e
Size

569KB
Sample

241110-zv3j1aykar
MD5

86eeb013dfd3de4342fb929338fee43f
SHA1

cb6091cd3f350ebe8bf47cdafda31922f555be70
SHA256

5f86b62d6d98cd4cb541a26e452f982c97efe11346e2e8f7a06be99e28d4173e
SHA512

02a57df9b14ebef6b4eea9e399358a49a7d5f9cd5eb38318fac7cf5a3ffde8cd43158b84095c4304004c912ac6f81bcd08e4573898216955463876951b173566
SSDEEP

12288:Dy90rhwqtgfoMkN0kOaFZiPOQ6dmnhY880x3aPQ/HA1GX5EcIx:DyG6qtgfyKa/Xnmnr8y1HRer

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

5f86b62d6d98cd4cb541a26e452f982c97efe11346e2e8f7a06be99e28d4173e.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  5f86b62d6d98cd4cb541a26e452f982c97efe11346e2e8f7a06be99e28d4173e
- Size
  
  569KB
- MD5
  
  86eeb013dfd3de4342fb929338fee43f
- SHA1
  
  cb6091cd3f350ebe8bf47cdafda31922f555be70
- SHA256
  
  5f86b62d6d98cd4cb541a26e452f982c97efe11346e2e8f7a06be99e28d4173e
- SHA512
  
  02a57df9b14ebef6b4eea9e399358a49a7d5f9cd5eb38318fac7cf5a3ffde8cd43158b84095c4304004c912ac6f81bcd08e4573898216955463876951b173566
- SSDEEP
  
  12288:Dy90rhwqtgfoMkN0kOaFZiPOQ6dmnhY880x3aPQ/HA1GX5EcIx:DyG6qtgfyKa/Xnmnr8y1HRer
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy