healer | be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb | Triage

Sharing

General

Target

be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb
Size

933KB
Sample

230924-b22dhsdc92
MD5

94c5ab840e8b4e75489f701e195c577b
SHA1

1f2c8492b75888b26cf4a3906a9d546abaf41627
SHA256

be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb
SHA512

e4594d8ca8375f3ac35b0bda42f7002ced3b558ff4832bf9407b4cee05366de0b497b5f0c28a13421926dcd7cb464315eb7186bc243917e599817ba592f62651
SSDEEP

24576:nyTDuksQFdmbrNhScd7PHWKP6diY8FCR2:yfuSFwbrNhS2z2CjYDR

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb
- Size
  
  933KB
- MD5
  
  94c5ab840e8b4e75489f701e195c577b
- SHA1
  
  1f2c8492b75888b26cf4a3906a9d546abaf41627
- SHA256
  
  be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb
- SHA512
  
  e4594d8ca8375f3ac35b0bda42f7002ced3b558ff4832bf9407b4cee05366de0b497b5f0c28a13421926dcd7cb464315eb7186bc243917e599817ba592f62651
- SSDEEP
  
  24576:nyTDuksQFdmbrNhScd7PHWKP6diY8FCR2:yfuSFwbrNhS2z2CjYDR
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan