healer | 13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484 | Triage

Sharing

General

Target

13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484
Size

994KB
Sample

230930-x32assfa2s
MD5

34ef23c18f8dad13ed7cfd023f5f29d4
SHA1

be19fd0f3452cec270a74be2bb7d7f4632d9ac5c
SHA256

13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484
SHA512

b1916c400525a82bbcd2cb01e36be9ad3fc391bf19ab954b7ae7d68ff32e6850aa76493d314086647a0faad0baaaa3607e94bab98b0f473e14f050922e93f3b9
SSDEEP

12288:3Mrgy90XfNF4s3hbXW0FclsuQbPDENDRJZaiiznv9heykaPsYFUbLR+bEc2N:7yQfNaMDFEsugPDeRJZa9lPsYgMq

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484
- Size
  
  994KB
- MD5
  
  34ef23c18f8dad13ed7cfd023f5f29d4
- SHA1
  
  be19fd0f3452cec270a74be2bb7d7f4632d9ac5c
- SHA256
  
  13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484
- SHA512
  
  b1916c400525a82bbcd2cb01e36be9ad3fc391bf19ab954b7ae7d68ff32e6850aa76493d314086647a0faad0baaaa3607e94bab98b0f473e14f050922e93f3b9
- SSDEEP
  
  12288:3Mrgy90XfNF4s3hbXW0FclsuQbPDENDRJZaiiznv9heykaPsYFUbLR+bEc2N:7yQfNaMDFEsugPDeRJZa9lPsYgMq
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan