healer | b401d72f271e2a9a7a126ea20116e8cbb7d3b2e784edde1400fa81b764775c81 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b401d72f271e2a9a7a126ea20116e8cbb7d3b2e784edde1400fa81b764775c81
Size

147KB
Sample

230716-tp8k6sgd5s
MD5

58896317997496c849d8e6c91bdbea9d
SHA1

04b4654cfef668da7e5a189cb28e6e5364273c4d
SHA256

b401d72f271e2a9a7a126ea20116e8cbb7d3b2e784edde1400fa81b764775c81
SHA512

10cf7f467a202eb8d0b42d4dccf561de098d5cdc3b9741543fac5878655fbddc10c83993494ac5972410f77137805492704ea441df7c0f70216d10ea843f807f
SSDEEP

3072:7i+3ghzzHrjiRLawelYplpQ0rlxWVLXfHXW:gdjiROwzLePrPXW

Score

10^/10

healer dropper evasion trojan

Malware Config

Targets

- Target
  
  b401d72f271e2a9a7a126ea20116e8cbb7d3b2e784edde1400fa81b764775c81
- Size
  
  147KB
- MD5
  
  58896317997496c849d8e6c91bdbea9d
- SHA1
  
  04b4654cfef668da7e5a189cb28e6e5364273c4d
- SHA256
  
  b401d72f271e2a9a7a126ea20116e8cbb7d3b2e784edde1400fa81b764775c81
- SHA512
  
  10cf7f467a202eb8d0b42d4dccf561de098d5cdc3b9741543fac5878655fbddc10c83993494ac5972410f77137805492704ea441df7c0f70216d10ea843f807f
- SSDEEP
  
  3072:7i+3ghzzHrjiRLawelYplpQ0rlxWVLXfHXW:gdjiROwzLePrPXW
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security modification
  evasion trojan
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan