healer | a7ccad9c3daa4f264a440390b409665dde7c8a8529697891a0ebf0b21ae17940 | Triage

Submit
Reports

Overview

overview

Static

static

3

a7ccad9c3d...0N.exe

windows10-2004-x64

Sharing

General

Target

a7ccad9c3daa4f264a440390b409665dde7c8a8529697891a0ebf0b21ae17940N.exe
Size

553KB
Sample

241119-mcxvkstgph
MD5

7c9ee3d6a685d23b7b84032441d1ac60
SHA1

634a4371ab4e0f62f939e58954665d8278992e79
SHA256

a7ccad9c3daa4f264a440390b409665dde7c8a8529697891a0ebf0b21ae17940
SHA512

703082b43830ec40d82015dbc810b876a45dd3a7e09ae55e2e35bede93fede1542a307c53bfb6d5e16879b1abe89eb2b5e57e4e6568ad0005e57b88f6e1dd7fc
SSDEEP

12288:By90uoTOpeIKuLWVkOv96JBBKEafKLzmUnJfCZ:ByDWuMuBKEafKLzmUnJfCZ

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a7ccad9c3daa4f264a440390b409665dde7c8a8529697891a0ebf0b21ae17940N.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

120 seconds

Malware Config

Targets

- Target
  
  a7ccad9c3daa4f264a440390b409665dde7c8a8529697891a0ebf0b21ae17940N.exe
- Size
  
  553KB
- MD5
  
  7c9ee3d6a685d23b7b84032441d1ac60
- SHA1
  
  634a4371ab4e0f62f939e58954665d8278992e79
- SHA256
  
  a7ccad9c3daa4f264a440390b409665dde7c8a8529697891a0ebf0b21ae17940
- SHA512
  
  703082b43830ec40d82015dbc810b876a45dd3a7e09ae55e2e35bede93fede1542a307c53bfb6d5e16879b1abe89eb2b5e57e4e6568ad0005e57b88f6e1dd7fc
- SSDEEP
  
  12288:By90uoTOpeIKuLWVkOv96JBBKEafKLzmUnJfCZ:ByDWuMuBKEafKLzmUnJfCZ
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy