healer | ede7f384ca1a10be0f81110eae25026ce0dd8666b93fb91fb766769cb7aa8c77 | Triage

Submit
Reports

Overview

overview

Static

static

3

ede7f384ca...77.exe

windows10-2004-x64

Sharing

General

Target

ede7f384ca1a10be0f81110eae25026ce0dd8666b93fb91fb766769cb7aa8c77
Size

923KB
Sample

241111-aydbvaycnj
MD5

bb7c254ea7fb7bf8dbdf33fa16b68e16
SHA1

37e260f0d675e6cdc3f4c55a9c7c7573aa15c445
SHA256

ede7f384ca1a10be0f81110eae25026ce0dd8666b93fb91fb766769cb7aa8c77
SHA512

1d0b08a6a30ac69d83b1f13b01f552807992cc6cba2b5f7944a34895827ba488cc2e0048b4064d66ea77e5f6dd96f546ced66418c720569918b80e8244c55188
SSDEEP

24576:Eyg+8wNGV8rNS8JD+TSwo7icSCIg4LTDb9qqamAUk9:TZWAw0ISn4Fg4XDb9P2

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ede7f384ca1a10be0f81110eae25026ce0dd8666b93fb91fb766769cb7aa8c77.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  ede7f384ca1a10be0f81110eae25026ce0dd8666b93fb91fb766769cb7aa8c77
- Size
  
  923KB
- MD5
  
  bb7c254ea7fb7bf8dbdf33fa16b68e16
- SHA1
  
  37e260f0d675e6cdc3f4c55a9c7c7573aa15c445
- SHA256
  
  ede7f384ca1a10be0f81110eae25026ce0dd8666b93fb91fb766769cb7aa8c77
- SHA512
  
  1d0b08a6a30ac69d83b1f13b01f552807992cc6cba2b5f7944a34895827ba488cc2e0048b4064d66ea77e5f6dd96f546ced66418c720569918b80e8244c55188
- SSDEEP
  
  24576:Eyg+8wNGV8rNS8JD+TSwo7icSCIg4LTDb9qqamAUk9:TZWAw0ISn4Fg4XDb9P2
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy