healer | 689db7e1029a3ad26de268aecb9e281f86c8a92789237940742c216d24a934aa | Triage

Submit
Reports

Overview

overview

Static

static

3

689db7e102...aN.exe

windows10-2004-x64

Sharing

General

Target

689db7e1029a3ad26de268aecb9e281f86c8a92789237940742c216d24a934aaN.exe
Size

762KB
Sample

241129-rhznkstqdr
MD5

b1a355d1fefb8f512d330490510bc0e0
SHA1

628d7a8d7e98474dbd23cf6da0ab50bfb4d6ab51
SHA256

689db7e1029a3ad26de268aecb9e281f86c8a92789237940742c216d24a934aa
SHA512

c9287d6c193c0ac0f833fe51c57810ee09d964771e7619e89313da6bcfe7d95254a6ee25085e87ba033aed40bd80e1fbea81f6ff76440f218bc59ed05f0b7aaf
SSDEEP

12288:Iy90aKeUzw82OB1obc4H3UzMzS2Hlq9s4xK8Owx548X9D2MFNUcw:Iy8e8w8X1v2//Hlqy4pOO48X/Ucw

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

689db7e1029a3ad26de268aecb9e281f86c8a92789237940742c216d24a934aaN.exe

Resource

win10v2004-20241007-en

healer redline discovery dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

120 seconds

Malware Config

Targets

- Target
  
  689db7e1029a3ad26de268aecb9e281f86c8a92789237940742c216d24a934aaN.exe
- Size
  
  762KB
- MD5
  
  b1a355d1fefb8f512d330490510bc0e0
- SHA1
  
  628d7a8d7e98474dbd23cf6da0ab50bfb4d6ab51
- SHA256
  
  689db7e1029a3ad26de268aecb9e281f86c8a92789237940742c216d24a934aa
- SHA512
  
  c9287d6c193c0ac0f833fe51c57810ee09d964771e7619e89313da6bcfe7d95254a6ee25085e87ba033aed40bd80e1fbea81f6ff76440f218bc59ed05f0b7aaf
- SSDEEP
  
  12288:Iy90aKeUzw82OB1obc4H3UzMzS2Hlq9s4xK8Owx548X9D2MFNUcw:Iy8e8w8X1v2//Hlqy4pOO48X/Ucw
Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerredlinediscoverydropperevasioninfostealerpersistencetrojan

© 2018-2024

Terms | Privacy