healer | 66021300799ff5f9e1ed4c1eb8d64143e26c5c5704aae297f1284dae8d7165f2 | Triage

Submit
Reports

Overview

overview

Static

static

3

6602130079...2N.exe

windows10-2004-x64

Sharing

General

Target

66021300799ff5f9e1ed4c1eb8d64143e26c5c5704aae297f1284dae8d7165f2N.exe
Size

807KB
Sample

241119-b26m8szarl
MD5

0ee96cb0e77cf7c539e0b901bfe3d190
SHA1

37e561f2afdce637994c6b235472dfce843a9ae8
SHA256

66021300799ff5f9e1ed4c1eb8d64143e26c5c5704aae297f1284dae8d7165f2
SHA512

77f181f32dd22a1bf0b67d173471851e69dc3ef86493dcd952a8a668536ec6a030996de0f4a7b2c43ff57ccfbf614a6b5a9590fd8618a99fc87a2dd2f99048ae
SSDEEP

24576:Wytx3KwVFrDqECxSQgwUiAzl0e0kDOQmG:ltxawrWxSQguOl0erOd

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

66021300799ff5f9e1ed4c1eb8d64143e26c5c5704aae297f1284dae8d7165f2N.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

14 signatures

120 seconds

Malware Config

Targets

- Target
  
  66021300799ff5f9e1ed4c1eb8d64143e26c5c5704aae297f1284dae8d7165f2N.exe
- Size
  
  807KB
- MD5
  
  0ee96cb0e77cf7c539e0b901bfe3d190
- SHA1
  
  37e561f2afdce637994c6b235472dfce843a9ae8
- SHA256
  
  66021300799ff5f9e1ed4c1eb8d64143e26c5c5704aae297f1284dae8d7165f2
- SHA512
  
  77f181f32dd22a1bf0b67d173471851e69dc3ef86493dcd952a8a668536ec6a030996de0f4a7b2c43ff57ccfbf614a6b5a9590fd8618a99fc87a2dd2f99048ae
- SSDEEP
  
  24576:Wytx3KwVFrDqECxSQgwUiAzl0e0kDOQmG:ltxawrWxSQguOl0erOd
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy