healer | 4e9d16a685f93d487bcb981f028d56474e52d83294d159c862c555ab213646e3 | Triage™

Login
Reports

Overview

overview

Static

static

3

4e9d16a685...e3.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
4e9d16a685f93d487bcb981f028d56474e52d83294d159c862c555ab213646e3
Size 1.4MB
Sample260915-s17ycaan7x
SHA256 4e9d16a685f93d487bcb981f028d56474e52d83294d159c862c555ab213646e3
MD5 7b036d643606c72d60190620a4f67be0
SHA1 c910ffa2e351e8f835758506b58e1922d799ee36
SHA512 72e9c1b471acdaec8180c972f0e3fb3e382acca2181c79c5224f5ddf054ef08807e96bb674be8561a64a64fd386fffbedd50b1f7d48183db06c39a4662fb2fdb
SSDEEP 24576:/yLtIXdxyrPQdQDZH2YGEY+15Jbx72K5eTjRUkLzwfKa7POcf7fJ+5F3UCV:KLmXdxk4KBhzY+1Pbx72KIWYzS7Wcf7
TLSH
T137653310EBEA8131C5B45BB42CF807873A33BD619D39939A3760469C49B3DE5E6343A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

healer redline masha defense_evasion discovery dropper evasion infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4e9d16a685f93d487bcb981f028d56474e52d83294d159c862c555ab213646e3.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

15 signatures

150 seconds

masha defense_evasion discovery dropper evasion healer redline infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

C2

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Targets

- Target
  4e9d16a685f93d487bcb981f028d56474e52d83294d159c862c555ab213646e3
- Size 1.4MB
- SHA256 4e9d16a685f93d487bcb981f028d56474e52d83294d159c862c555ab213646e3
- MD5 7b036d643606c72d60190620a4f67be0
- SHA1 c910ffa2e351e8f835758506b58e1922d799ee36
- SHA512 72e9c1b471acdaec8180c972f0e3fb3e382acca2181c79c5224f5ddf054ef08807e96bb674be8561a64a64fd386fffbedd50b1f7d48183db06c39a4662fb2fdb
- SSDEEP 24576:/yLtIXdxyrPQdQDZH2YGEY+15Jbx72K5eTjRUkLzwfKa7POcf7fJ+5F3UCV:KLmXdxk4KBhzY+1Pbx72KIWYzS7Wcf7
- TLSH
  T137653310EBEA8131C5B45BB42CF807873A33BD619D39939A3760469C49B3DE5E6343A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

masha defense_evasion discovery dropper evasion healer redline infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Family: Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- RedLine payload
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

mashadefense_evasiondiscoverydropperevasionhealerredlineinfostealerpersistencetrojan

© 2018-2026

Terms | Privacy