healer | 2ac61eb9a82b64376e9c58c081f6de7fa55a62b65b583bb90dd48dc1ec8049a6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

q3503457.exe
Size

19KB
Sample

230904-bsczkadd37
MD5

2d0b7b6c6582624ab6f37a8a0012a15b
SHA1

ba6fb65835289d18b7c6955a08db13e9f4b7dee3
SHA256

2ac61eb9a82b64376e9c58c081f6de7fa55a62b65b583bb90dd48dc1ec8049a6
SHA512

d80073aca35a0b8454414ae3d3b961ee4c70bf4ae1ee028b35c197eef62e04f4af0a2bf0468f532c3ae0117de18f83ceabdd1e7fe830b19d419feb64eb284df0
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

healer dropper evasion trojan

Malware Config

Targets

- Target
  
  q3503457.exe
- Size
  
  19KB
- MD5
  
  2d0b7b6c6582624ab6f37a8a0012a15b
- SHA1
  
  ba6fb65835289d18b7c6955a08db13e9f4b7dee3
- SHA256
  
  2ac61eb9a82b64376e9c58c081f6de7fa55a62b65b583bb90dd48dc1ec8049a6
- SHA512
  
  d80073aca35a0b8454414ae3d3b961ee4c70bf4ae1ee028b35c197eef62e04f4af0a2bf0468f532c3ae0117de18f83ceabdd1e7fe830b19d419feb64eb284df0
- SSDEEP
  
  96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan

behavioral2

healerdropperevasiontrojan