healer | 6be677a5ada91a91bb7a10fc4857c79d92bd87fff3b24c724791cc674b93c917 | Triage

Sharing

General

Target

q3837275.exe
Size

18KB
Sample

230904-btqbaada2w
MD5

077064a75fb7a2e177febcc9741d4421
SHA1

882a338b949f1e9321d91d54d7f31f7f13e2f180
SHA256

6be677a5ada91a91bb7a10fc4857c79d92bd87fff3b24c724791cc674b93c917
SHA512

8377ea609d1974cec8ef03189119c8784e492e06881ebe484997fc1b368b7d3b7b8e38c1cdec08f184f0914193f5f547a3e243b7bce984908b9920007c6e2036
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

healer dropper evasion trojan

Malware Config

Targets

- Target
  
  q3837275.exe
- Size
  
  18KB
- MD5
  
  077064a75fb7a2e177febcc9741d4421
- SHA1
  
  882a338b949f1e9321d91d54d7f31f7f13e2f180
- SHA256
  
  6be677a5ada91a91bb7a10fc4857c79d92bd87fff3b24c724791cc674b93c917
- SHA512
  
  8377ea609d1974cec8ef03189119c8784e492e06881ebe484997fc1b368b7d3b7b8e38c1cdec08f184f0914193f5f547a3e243b7bce984908b9920007c6e2036
- SSDEEP
  
  96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan

behavioral2

healerdropperevasiontrojan