healer | 5d7aca046c52ba7c34c49e526918b2e0e16153165a1f645713fe60480128fa17 | Triage

Sharing

General

Target

g8003181.exe
Size

242KB
Sample

230918-b1v54sgd66
MD5

4db2aca858ec494990998fe2c03c1c07
SHA1

2022128ff3da5a76d6b4c5aaea5d1cbae5b25660
SHA256

5d7aca046c52ba7c34c49e526918b2e0e16153165a1f645713fe60480128fa17
SHA512

4e819cae3fc87403f5ccd0c324e86e0c4c594591064097181eda0d158f7313803bba2acfacd9038014bb4c870b9ce53bc5fe604be11aa864b70e789982a4089b
SSDEEP

3072:c2cG6IBtVVzkEmJth+9p1ORs+NJ2uvHJ5TMi473cceipyEAeAg0FujDU6fQJupkE:cwvJm09zORs+z/TMify9DAOM+Qga8/

Score

10^/10

healer dropper evasion trojan

Malware Config

Targets

- Target
  
  g8003181.exe
- Size
  
  242KB
- MD5
  
  4db2aca858ec494990998fe2c03c1c07
- SHA1
  
  2022128ff3da5a76d6b4c5aaea5d1cbae5b25660
- SHA256
  
  5d7aca046c52ba7c34c49e526918b2e0e16153165a1f645713fe60480128fa17
- SHA512
  
  4e819cae3fc87403f5ccd0c324e86e0c4c594591064097181eda0d158f7313803bba2acfacd9038014bb4c870b9ce53bc5fe604be11aa864b70e789982a4089b
- SSDEEP
  
  3072:c2cG6IBtVVzkEmJth+9p1ORs+NJ2uvHJ5TMi473cceipyEAeAg0FujDU6fQJupkE:cwvJm09zORs+z/TMify9DAOM+Qga8/
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan

behavioral2

healerdropperevasiontrojan