healer | 7df44fc7e38a00c98f4c5b4392a085aa7acd683908511b6db11cb86da8111b90 | Triage

Sharing

General

Target

7df44fc7e38a00c98f4c5b4392a085aa7acd683908511b6db11cb86da8111b90
Size

1.3MB
Sample

230921-kxkdwaeh8y
MD5

bb43aabe94cd4da7d2c1a3b4cdb8a25b
SHA1

326e19db89a82e7e42384b41c3b5f0930806eb89
SHA256

7df44fc7e38a00c98f4c5b4392a085aa7acd683908511b6db11cb86da8111b90
SHA512

8da08b9d2903c730f32643afd61bb1235d05b3dd7698b456016a6d8e7ef22a8c58e1314eb50d7170ac6af96c8fbfa4c0056878a59f907c355c0d1fbb9317cf36
SSDEEP

24576:+yyL0rARXHB9OOSdVgUGYld9BCXc9hbov1xTXttLqr7deZQCa:NynNLjC94QbA1dd48ZP

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  7df44fc7e38a00c98f4c5b4392a085aa7acd683908511b6db11cb86da8111b90
- Size
  
  1.3MB
- MD5
  
  bb43aabe94cd4da7d2c1a3b4cdb8a25b
- SHA1
  
  326e19db89a82e7e42384b41c3b5f0930806eb89
- SHA256
  
  7df44fc7e38a00c98f4c5b4392a085aa7acd683908511b6db11cb86da8111b90
- SHA512
  
  8da08b9d2903c730f32643afd61bb1235d05b3dd7698b456016a6d8e7ef22a8c58e1314eb50d7170ac6af96c8fbfa4c0056878a59f907c355c0d1fbb9317cf36
- SSDEEP
  
  24576:+yyL0rARXHB9OOSdVgUGYld9BCXc9hbov1xTXttLqr7deZQCa:NynNLjC94QbA1dd48ZP
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan