healer | 9d70cb7b53f4cd0cc89cba7d5729a7a6ab1f330fbf144f4aabb108992dc62200 | Triage™

Login
Reports

Overview

overview

Static

static

3

9d70cb7b53...00.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
9d70cb7b53f4cd0cc89cba7d5729a7a6ab1f330fbf144f4aabb108992dc62200.bin
Size 816KB
Sample260913-fy28vstzdw
SHA256 9d70cb7b53f4cd0cc89cba7d5729a7a6ab1f330fbf144f4aabb108992dc62200
MD5 764a99985db5353cbf475799ee0b1539
SHA1 1075afb71c881fb28ceb118ffdc0d938b4fd7a92
SHA512 e4a02dc9cec048c78763714765c47751e5f2732e6ae4f7dedc87932ea4c4b2ffe618d1eeb5ff8f5886e4bc7481a272e1c3875d0a5ff702b6486996cc7e3bc31e
SSDEEP 12288:sMrSy90AXe9rMQn4ajaF58h8vcO/VL8gB3ZehcE2B+w0Ea6rSyGgoDip+YThKLfR:uyzuAXiaFbvcIiqohcmYtGgohaefpz
TLSH
T17C05220267D94433C8F537B094FA47C71B317CB5ACB9C31E26456A2E4CF2294AA7276B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

healer redline rosn defense_evasion discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9d70cb7b53f4cd0cc89cba7d5729a7a6ab1f330fbf144f4aabb108992dc62200.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

16 signatures

150 seconds

rosn defense_evasion discovery dropper evasion healer redline infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Targets

- Target
  9d70cb7b53f4cd0cc89cba7d5729a7a6ab1f330fbf144f4aabb108992dc62200.bin
- Size 816KB
- SHA256 9d70cb7b53f4cd0cc89cba7d5729a7a6ab1f330fbf144f4aabb108992dc62200
- MD5 764a99985db5353cbf475799ee0b1539
- SHA1 1075afb71c881fb28ceb118ffdc0d938b4fd7a92
- SHA512 e4a02dc9cec048c78763714765c47751e5f2732e6ae4f7dedc87932ea4c4b2ffe618d1eeb5ff8f5886e4bc7481a272e1c3875d0a5ff702b6486996cc7e3bc31e
- SSDEEP 12288:sMrSy90AXe9rMQn4ajaF58h8vcO/VL8gB3ZehcE2B+w0Ea6rSyGgoDip+YThKLfR:uyzuAXiaFbvcIiqohcmYtGgohaefpz
- TLSH
  T17C05220267D94433C8F537B094FA47C71B317CB5ACB9C31E26456A2E4CF2294AA7276B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

rosn defense_evasion discovery dropper evasion healer redline infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Family: Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- RedLine payload
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

rosndefense_evasiondiscoverydropperevasionhealerredlineinfostealerpersistencetrojan

© 2018-2026

Terms | Privacy