healer | cb86ac0718e455fc519269fc5b36823c514d89229e647581f36ec77646968ac2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cb86ac0718e455fc519269fc5b36823c514d89229e647581f36ec77646968ac2
Size

876KB
Sample

231003-dad51sfh71
MD5

ac97270a5470745eda751faf08d6b12f
SHA1

f2d090a0afbf159d39cd1bf29aab30e37fb3d8d5
SHA256

cb86ac0718e455fc519269fc5b36823c514d89229e647581f36ec77646968ac2
SHA512

f944bafea1e471fc78e3b6dc71d46f8f8282195734ce3382999455e0c01c461e0f12bc3cebb4d79431a04f477e34eb122ba39492fa409a9d501d1052ce9acce6
SSDEEP

24576:7ydDHOiHVqofGIp4JetcUuVv2v3W9kSSE2i:ulHOmqof52euPVv2vs3

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  cb86ac0718e455fc519269fc5b36823c514d89229e647581f36ec77646968ac2
- Size
  
  876KB
- MD5
  
  ac97270a5470745eda751faf08d6b12f
- SHA1
  
  f2d090a0afbf159d39cd1bf29aab30e37fb3d8d5
- SHA256
  
  cb86ac0718e455fc519269fc5b36823c514d89229e647581f36ec77646968ac2
- SHA512
  
  f944bafea1e471fc78e3b6dc71d46f8f8282195734ce3382999455e0c01c461e0f12bc3cebb4d79431a04f477e34eb122ba39492fa409a9d501d1052ce9acce6
- SSDEEP
  
  24576:7ydDHOiHVqofGIp4JetcUuVv2v3W9kSSE2i:ulHOmqof52euPVv2vs3
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan