healer | 0a12539bfc8f57d283ca7f227ef918228bc0afb342726892903fb6d5b4e4df56 | Triage

Submit
Reports

Overview

overview

Static

static

3

0a12539bfc...56.exe

windows10-2004-x64

Sharing

General

Target

0a12539bfc8f57d283ca7f227ef918228bc0afb342726892903fb6d5b4e4df56
Size

611KB
Sample

241111-b175nsynhv
MD5

e9e19db0e018ceb578c2f0391d0eef62
SHA1

dc1f625b24f054f4541d59e3a6ab961bb6e25e2a
SHA256

0a12539bfc8f57d283ca7f227ef918228bc0afb342726892903fb6d5b4e4df56
SHA512

228cb6fc3e22ed99765cc1914e858b4fda1c8c316c855d09b8bd265085fc15923dc5e10d661637245e6408bffc99019c57a33748ab683d0b6e7507f9488f87b8
SSDEEP

12288:jy90h+IqYVYk8jDlOf6O9LCutAXCdJpZRl8j40Wi:jys++Va/Mf6EDAXiJpZD8jT

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0a12539bfc8f57d283ca7f227ef918228bc0afb342726892903fb6d5b4e4df56.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  0a12539bfc8f57d283ca7f227ef918228bc0afb342726892903fb6d5b4e4df56
- Size
  
  611KB
- MD5
  
  e9e19db0e018ceb578c2f0391d0eef62
- SHA1
  
  dc1f625b24f054f4541d59e3a6ab961bb6e25e2a
- SHA256
  
  0a12539bfc8f57d283ca7f227ef918228bc0afb342726892903fb6d5b4e4df56
- SHA512
  
  228cb6fc3e22ed99765cc1914e858b4fda1c8c316c855d09b8bd265085fc15923dc5e10d661637245e6408bffc99019c57a33748ab683d0b6e7507f9488f87b8
- SSDEEP
  
  12288:jy90h+IqYVYk8jDlOf6O9LCutAXCdJpZRl8j40Wi:jys++Va/Mf6EDAXiJpZD8jT
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy