healer | df5d1075f88d7c70485ce271ac216064bc3c0954442d71be408c214f7fe5cc84 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

df5d1075f88d7c70485ce271ac216064bc3c0954442d71be408c214f7fe5cc84
Size

147KB
Sample

230721-gl3jjach4v
MD5

ec7dfb17bbc461612bc8fc7e80a117eb
SHA1

f5c11bdaf3aa70763749d1635661cc63ac082657
SHA256

df5d1075f88d7c70485ce271ac216064bc3c0954442d71be408c214f7fe5cc84
SHA512

9bc25b31b740c0598782beb387906e9234a89839caec74eb0e62688924024d360058ff36326cea9957e6ba509f5c2892cd3b27b4b862154061d3b6fdb4791d17
SSDEEP

3072:KlZ3TFfpCRzzwQjiRb5welYpK23rlx4cLXfHXW:er8LjiRVwz86rPXW

Score

10^/10

healer dropper evasion trojan

Malware Config

Targets

- Target
  
  df5d1075f88d7c70485ce271ac216064bc3c0954442d71be408c214f7fe5cc84
- Size
  
  147KB
- MD5
  
  ec7dfb17bbc461612bc8fc7e80a117eb
- SHA1
  
  f5c11bdaf3aa70763749d1635661cc63ac082657
- SHA256
  
  df5d1075f88d7c70485ce271ac216064bc3c0954442d71be408c214f7fe5cc84
- SHA512
  
  9bc25b31b740c0598782beb387906e9234a89839caec74eb0e62688924024d360058ff36326cea9957e6ba509f5c2892cd3b27b4b862154061d3b6fdb4791d17
- SSDEEP
  
  3072:KlZ3TFfpCRzzwQjiRb5welYpK23rlx4cLXfHXW:er8LjiRVwz86rPXW
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security modification
  evasion trojan
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan