healer | 1a075eec18c52161447b292da5596b7cc899ccb82b35932dc1c6cecbec7c3fde | Triage

Submit
Reports

Overview

overview

Static

static

3

1a075eec18...de.exe

windows10-2004-x64

Sharing

General

Target

1a075eec18c52161447b292da5596b7cc899ccb82b35932dc1c6cecbec7c3fde
Size

936KB
Sample

241111-cp3lgs1bja
MD5

a873a955ae271cc465f8c25b45d8d5f7
SHA1

67fa09abae57444e28be4860d28d4493a2126fad
SHA256

1a075eec18c52161447b292da5596b7cc899ccb82b35932dc1c6cecbec7c3fde
SHA512

847d27ecc6bc5f065197dd06e51ee926e5dd1145e59d0c6d87f5405894401abd07ce11a04e757d6877e39aab5115101e00c4c4806de2124b9bbe2cd25e4bf9ff
SSDEEP

24576:Syvddns8HafdsRcKsAGF5QgcY0p0UJfFiByj9px5f2C4t2:5vPsJs2KsAGF+s0TfYgWC4

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1a075eec18c52161447b292da5596b7cc899ccb82b35932dc1c6cecbec7c3fde.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  1a075eec18c52161447b292da5596b7cc899ccb82b35932dc1c6cecbec7c3fde
- Size
  
  936KB
- MD5
  
  a873a955ae271cc465f8c25b45d8d5f7
- SHA1
  
  67fa09abae57444e28be4860d28d4493a2126fad
- SHA256
  
  1a075eec18c52161447b292da5596b7cc899ccb82b35932dc1c6cecbec7c3fde
- SHA512
  
  847d27ecc6bc5f065197dd06e51ee926e5dd1145e59d0c6d87f5405894401abd07ce11a04e757d6877e39aab5115101e00c4c4806de2124b9bbe2cd25e4bf9ff
- SSDEEP
  
  24576:Syvddns8HafdsRcKsAGF5QgcY0p0UJfFiByj9px5f2C4t2:5vPsJs2KsAGF+s0TfYgWC4
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy