healer | 6ee62187d822d8f0a8136a48874aab4b6892bf6804b5d5f294e17e9018bd0a15 | Triage

Sharing

General

Target

6ee62187d822d8f0a8136a48874aab4b6892bf6804b5d5f294e17e9018bd0a15
Size

1.1MB
Sample

230922-tamp6aba47
MD5

86cce3df19d7435978f2755ba5a054f2
SHA1

eb78f26da3413745e1c9f5b4ce1fbdafcd2d9a6b
SHA256

6ee62187d822d8f0a8136a48874aab4b6892bf6804b5d5f294e17e9018bd0a15
SHA512

5f28506d0f012b5ef3876a80bd71ee3c3a537a3faf5b4daa4002ed90b51621af8e34f9bb0931c0d29baa17a8a4fad99b9014fbfa3211e7daaca5cbef4ed85c0d
SSDEEP

24576:byNf7DpKAsyjbssEXUWdQ4TYJf5WiEVs16dWQ7x:ONjYEbbvW38Jf5WfeyWQ7

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  6ee62187d822d8f0a8136a48874aab4b6892bf6804b5d5f294e17e9018bd0a15
- Size
  
  1.1MB
- MD5
  
  86cce3df19d7435978f2755ba5a054f2
- SHA1
  
  eb78f26da3413745e1c9f5b4ce1fbdafcd2d9a6b
- SHA256
  
  6ee62187d822d8f0a8136a48874aab4b6892bf6804b5d5f294e17e9018bd0a15
- SHA512
  
  5f28506d0f012b5ef3876a80bd71ee3c3a537a3faf5b4daa4002ed90b51621af8e34f9bb0931c0d29baa17a8a4fad99b9014fbfa3211e7daaca5cbef4ed85c0d
- SSDEEP
  
  24576:byNf7DpKAsyjbssEXUWdQ4TYJf5WiEVs16dWQ7x:ONjYEbbvW38Jf5WfeyWQ7
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan