healer | 6d8a991e9729370076ce86b8ea90e19fe602a7e576c7433949cf89942a733947 | Triage

Submit
Reports

Overview

overview

Static

static

3

6d8a991e97...7N.exe

windows10-2004-x64

Sharing

General

Target

6d8a991e9729370076ce86b8ea90e19fe602a7e576c7433949cf89942a733947N.exe
Size

706KB
Sample

241118-3dd2vsyamp
MD5

c677fd34d9750aace8e323d15c81f710
SHA1

331b6493456c9801ef43bdbc7ca77017f61b0b42
SHA256

6d8a991e9729370076ce86b8ea90e19fe602a7e576c7433949cf89942a733947
SHA512

19c626c727f8714aeb5890cb5649b9a97802da5eef1f5c9fd4a129b993f1075c8a62f6214680d9722af554febc31e2946fe04a8c011dc67c61ce013fa738a80b
SSDEEP

12288:Zy90/NsSMCokxbAhnJJ+QiQZgrciUxODcHEXw1m:ZyQsExMgrlUxUdF

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

6d8a991e9729370076ce86b8ea90e19fe602a7e576c7433949cf89942a733947N.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

120 seconds

Malware Config

Targets

- Target
  
  6d8a991e9729370076ce86b8ea90e19fe602a7e576c7433949cf89942a733947N.exe
- Size
  
  706KB
- MD5
  
  c677fd34d9750aace8e323d15c81f710
- SHA1
  
  331b6493456c9801ef43bdbc7ca77017f61b0b42
- SHA256
  
  6d8a991e9729370076ce86b8ea90e19fe602a7e576c7433949cf89942a733947
- SHA512
  
  19c626c727f8714aeb5890cb5649b9a97802da5eef1f5c9fd4a129b993f1075c8a62f6214680d9722af554febc31e2946fe04a8c011dc67c61ce013fa738a80b
- SSDEEP
  
  12288:Zy90/NsSMCokxbAhnJJ+QiQZgrciUxODcHEXw1m:ZyQsExMgrlUxUdF
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy