healer | 9c4d9abf16b3994f884a5bbc542f7dcdcf0febff0531118d3e2846de02dfa91e | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

9c4d9abf16...1e.exe

windows10-2004-x64

Sharing

General

Target

9c4d9abf16b3994f884a5bbc542f7dcdcf0febff0531118d3e2846de02dfa91e
Size

694KB
Sample

241111-cz79qatpdn
MD5

7823737a9edc94ef4c04ca56ea1f805d
SHA1

4f7588d3e45a9dfe139094056660412406c1ee44
SHA256

9c4d9abf16b3994f884a5bbc542f7dcdcf0febff0531118d3e2846de02dfa91e
SHA512

380f5a5864aae042b434544ff30d6491aa070b4314433ea2b82f756f85edc32bc385b540dbe029141a1745ce54e96f07ccbf6a858062b06661810f3f990fac45
SSDEEP

12288:Jy902qwcaSJdYpVdeodEG23VpnkKBehP1x3eKHD1Uc5vleu2KfEPqa8+BlEmqo0Y:JyOabH/dEGa9AP1xvHD1UAWKf0q3+jE6

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9c4d9abf16b3994f884a5bbc542f7dcdcf0febff0531118d3e2846de02dfa91e.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  9c4d9abf16b3994f884a5bbc542f7dcdcf0febff0531118d3e2846de02dfa91e
- Size
  
  694KB
- MD5
  
  7823737a9edc94ef4c04ca56ea1f805d
- SHA1
  
  4f7588d3e45a9dfe139094056660412406c1ee44
- SHA256
  
  9c4d9abf16b3994f884a5bbc542f7dcdcf0febff0531118d3e2846de02dfa91e
- SHA512
  
  380f5a5864aae042b434544ff30d6491aa070b4314433ea2b82f756f85edc32bc385b540dbe029141a1745ce54e96f07ccbf6a858062b06661810f3f990fac45
- SSDEEP
  
  12288:Jy902qwcaSJdYpVdeodEG23VpnkKBehP1x3eKHD1Uc5vleu2KfEPqa8+BlEmqo0Y:JyOabH/dEGa9AP1xvHD1UAWKf0q3+jE6
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.