healer | a1d6be93ea1f7051e19504af5388665ecf5862be51cdb1df4895ab196defbf74 | Triage

Sharing

General

Target

a1d6be93ea1f7051e19504af5388665ecf5862be51cdb1df4895ab196defbf74
Size

1.1MB
Sample

230929-yq6kesed9s
MD5

1ff470ae4b3f8ee1d4b2d7f65932a039
SHA1

c4b0207ad5f5f7eaa48fe613f2b246d4cb405cb0
SHA256

a1d6be93ea1f7051e19504af5388665ecf5862be51cdb1df4895ab196defbf74
SHA512

cb167a7cebb137e21ff67f6d902971630ad11a1e2ec983285284f9b86fa291d5661c43378f31902e8c5d4802c95f59cf6836f261f875c3a32768fbee7f526c5a
SSDEEP

24576:zydja0Du8udg9EXNFsrHKrXN4A044gP+eu:GVAg9EdaGr9EngP+e

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  a1d6be93ea1f7051e19504af5388665ecf5862be51cdb1df4895ab196defbf74
- Size
  
  1.1MB
- MD5
  
  1ff470ae4b3f8ee1d4b2d7f65932a039
- SHA1
  
  c4b0207ad5f5f7eaa48fe613f2b246d4cb405cb0
- SHA256
  
  a1d6be93ea1f7051e19504af5388665ecf5862be51cdb1df4895ab196defbf74
- SHA512
  
  cb167a7cebb137e21ff67f6d902971630ad11a1e2ec983285284f9b86fa291d5661c43378f31902e8c5d4802c95f59cf6836f261f875c3a32768fbee7f526c5a
- SSDEEP
  
  24576:zydja0Du8udg9EXNFsrHKrXN4A044gP+eu:GVAg9EdaGr9EngP+e
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan