healer | 44b9af7d1be473a95695279d0362372f7fa07b9ea9550cf22bee71c99ae447dc | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

44b9af7d1b...dc.exe

windows10-2004-x64

Sharing

General

Target

44b9af7d1be473a95695279d0362372f7fa07b9ea9550cf22bee71c99ae447dc
Size

483KB
Sample

241111-lj6wdswqax
MD5

98fdc2b0aee01204c80f65de177489ce
SHA1

42988b19f3b4d0b2ff2275e46d0eb69095e54409
SHA256

44b9af7d1be473a95695279d0362372f7fa07b9ea9550cf22bee71c99ae447dc
SHA512

4ac5c5e6d59a7f65130af11ec2474f6dc3abf676d1b70b94b23b288b77f45ea48174f880c54b9c19036f44cd2dae3956af9b05e34ac2a7cac22dfa8c11d133f6
SSDEEP

12288:2MrMy90xcfIH8F5Yz4Z7ps7YAw5n1SkwsDeEgml:OyffIcrYz+7pfAw5n1zJgml

Score

10^/10

healer redline fukia discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

44b9af7d1be473a95695279d0362372f7fa07b9ea9550cf22bee71c99ae447dc.exe

Resource

win10v2004-20241007-en

healer redline fukia discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes

auth_value
e5783636fbd9e4f0cf9a017bce02e67e

Targets

- Target
  
  44b9af7d1be473a95695279d0362372f7fa07b9ea9550cf22bee71c99ae447dc
- Size
  
  483KB
- MD5
  
  98fdc2b0aee01204c80f65de177489ce
- SHA1
  
  42988b19f3b4d0b2ff2275e46d0eb69095e54409
- SHA256
  
  44b9af7d1be473a95695279d0362372f7fa07b9ea9550cf22bee71c99ae447dc
- SHA512
  
  4ac5c5e6d59a7f65130af11ec2474f6dc3abf676d1b70b94b23b288b77f45ea48174f880c54b9c19036f44cd2dae3956af9b05e34ac2a7cac22dfa8c11d133f6
- SSDEEP
  
  12288:2MrMy90xcfIH8F5Yz4Z7ps7YAw5n1SkwsDeEgml:OyffIcrYz+7pfAw5n1zJgml
Score

10^/10

healer redline fukia discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinefukiadiscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.