healer | ecfd9b4d07a9210a62683072a261866c31fff620a0d672890f625e8e50a96670 | Triage

Sharing

General

Target

ecfd9b4d07a9210a62683072a261866c31fff620a0d672890f625e8e50a96670
Size

146KB
Sample

230718-ejr9nsgh4y
MD5

d359067886e52366342c555fdf9f2744
SHA1

790bfb2dd4995a93f65ec1db0bcfd19e50809517
SHA256

ecfd9b4d07a9210a62683072a261866c31fff620a0d672890f625e8e50a96670
SHA512

1ddbaa957e7b197c2b4b78f7cc80c8b15b265a7d135377e538b66aa954aa2acd3eea9a09f353e72e860ad13f2884d3d8cc01d496298c709c2fe4c79b6e6d3811
SSDEEP

3072:KlZ3TFfpCRzzwQjiRb5welYpK23rlx4cLXfHXW:er8LjiRVwz86rPXW

Score

10^/10

healer dropper evasion trojan

Malware Config

Targets

- Target
  
  ecfd9b4d07a9210a62683072a261866c31fff620a0d672890f625e8e50a96670
- Size
  
  146KB
- MD5
  
  d359067886e52366342c555fdf9f2744
- SHA1
  
  790bfb2dd4995a93f65ec1db0bcfd19e50809517
- SHA256
  
  ecfd9b4d07a9210a62683072a261866c31fff620a0d672890f625e8e50a96670
- SHA512
  
  1ddbaa957e7b197c2b4b78f7cc80c8b15b265a7d135377e538b66aa954aa2acd3eea9a09f353e72e860ad13f2884d3d8cc01d496298c709c2fe4c79b6e6d3811
- SSDEEP
  
  3072:KlZ3TFfpCRzzwQjiRb5welYpK23rlx4cLXfHXW:er8LjiRVwz86rPXW
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security modification
  evasion trojan
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan