healer | 4d299106b06d7d75e798acac2932f2a1fc096b1ddccbce1f772f5be7d419d581 | Triage

Sharing

General

Target

4d299106b06d7d75e798acac2932f2a1fc096b1ddccbce1f772f5be7d419d581
Size

147KB
Sample

230720-s7mkzshh91
MD5

fa0ae6a7300541eaa3133fa925f52997
SHA1

7b7993a4fc92dd0732d23a43d59c154132c2cb55
SHA256

4d299106b06d7d75e798acac2932f2a1fc096b1ddccbce1f772f5be7d419d581
SHA512

b38fb133ad55d4e2d5c50e2f9129e429d43c02746dd139b8d38fe011d2841ba729efe2c432ad37c642ef61ec59ab66e698ed82982cf060186be9b805b8b123b6
SSDEEP

3072:KlZ3TFfpCRzzwQjiRb5welYpK23rlx4cLXfHXW:er8LjiRVwz86rPXW

Score

10^/10

healer dropper evasion trojan

Malware Config

Targets

- Target
  
  4d299106b06d7d75e798acac2932f2a1fc096b1ddccbce1f772f5be7d419d581
- Size
  
  147KB
- MD5
  
  fa0ae6a7300541eaa3133fa925f52997
- SHA1
  
  7b7993a4fc92dd0732d23a43d59c154132c2cb55
- SHA256
  
  4d299106b06d7d75e798acac2932f2a1fc096b1ddccbce1f772f5be7d419d581
- SHA512
  
  b38fb133ad55d4e2d5c50e2f9129e429d43c02746dd139b8d38fe011d2841ba729efe2c432ad37c642ef61ec59ab66e698ed82982cf060186be9b805b8b123b6
- SSDEEP
  
  3072:KlZ3TFfpCRzzwQjiRb5welYpK23rlx4cLXfHXW:er8LjiRVwz86rPXW
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security modification
  evasion trojan
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan