healer | 58a13efad5fed21f56da382284e895b969b5fcc16f3cd20f4a9183c7fcde8604 | Triage

Submit
Reports

Overview

overview

Static

static

3

58a13efad5...04.exe

windows10-2004-x64

Sharing

General

Target

58a13efad5fed21f56da382284e895b969b5fcc16f3cd20f4a9183c7fcde8604.exe
Size

624KB
Sample

241119-m4z41swapl
MD5

c0e38ceb9bd20f002e032a1fcd4aa7e2
SHA1

46f671d80d56a6c0e49107672d5f2f01a8757d6b
SHA256

58a13efad5fed21f56da382284e895b969b5fcc16f3cd20f4a9183c7fcde8604
SHA512

b7a07ae37e77986ddc9241f2ffef5470c59b992be410d3663726fe491537d22cce4524310488ba08faa228136620750048685d31cef4c8fb7c9344088a8a402e
SSDEEP

12288:dy90JAT3rXD3ke5hrG25ACigptReVu0Khbfog79RnbJeNTqrsQA:dy6+35XrGCigptiOZwgbF2+4QA

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

58a13efad5fed21f56da382284e895b969b5fcc16f3cd20f4a9183c7fcde8604.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

14 signatures

120 seconds

Malware Config

Targets

- Target
  
  58a13efad5fed21f56da382284e895b969b5fcc16f3cd20f4a9183c7fcde8604.exe
- Size
  
  624KB
- MD5
  
  c0e38ceb9bd20f002e032a1fcd4aa7e2
- SHA1
  
  46f671d80d56a6c0e49107672d5f2f01a8757d6b
- SHA256
  
  58a13efad5fed21f56da382284e895b969b5fcc16f3cd20f4a9183c7fcde8604
- SHA512
  
  b7a07ae37e77986ddc9241f2ffef5470c59b992be410d3663726fe491537d22cce4524310488ba08faa228136620750048685d31cef4c8fb7c9344088a8a402e
- SSDEEP
  
  12288:dy90JAT3rXD3ke5hrG25ACigptReVu0Khbfog79RnbJeNTqrsQA:dy6+35XrGCigptiOZwgbF2+4QA
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy