healer | 1a75bd7ed8f439d053613e56eedba10e84031b450a2b4292beadf035602cae0d | Triage

Submit
Reports

Overview

overview

Static

static

3

1a75bd7ed8...0d.exe

windows10-2004-x64

Sharing

General

Target

1a75bd7ed8f439d053613e56eedba10e84031b450a2b4292beadf035602cae0d.exe
Size

414KB
Sample

241118-vkzcda1gjp
MD5

ee274e04c1b38f53cacf5edcc8c54dcd
SHA1

df819c1496e18e9f4b9bcc393d33c52cd6cf52f7
SHA256

1a75bd7ed8f439d053613e56eedba10e84031b450a2b4292beadf035602cae0d
SHA512

999e0ca90262f439d7f6323f91a550b88e1d67b750396806659de8cbcab5f7177980ae4d715f55f0698edd0f5460adb48de3e5408db40c2de7c53a403a7aa313
SSDEEP

6144:Ivp0yN90QEFnIIXPCc6RFJeZBmJWUyNe+hQV9wK3t3gPSHMfHuPk:1y90LpXPj60YizowKd3FguPk

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1a75bd7ed8f439d053613e56eedba10e84031b450a2b4292beadf035602cae0d.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

14 signatures

120 seconds

Malware Config

Targets

- Target
  
  1a75bd7ed8f439d053613e56eedba10e84031b450a2b4292beadf035602cae0d.exe
- Size
  
  414KB
- MD5
  
  ee274e04c1b38f53cacf5edcc8c54dcd
- SHA1
  
  df819c1496e18e9f4b9bcc393d33c52cd6cf52f7
- SHA256
  
  1a75bd7ed8f439d053613e56eedba10e84031b450a2b4292beadf035602cae0d
- SHA512
  
  999e0ca90262f439d7f6323f91a550b88e1d67b750396806659de8cbcab5f7177980ae4d715f55f0698edd0f5460adb48de3e5408db40c2de7c53a403a7aa313
- SSDEEP
  
  6144:Ivp0yN90QEFnIIXPCc6RFJeZBmJWUyNe+hQV9wK3t3gPSHMfHuPk:1y90LpXPj60YizowKd3FguPk
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy