healer | f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c | Triage

Sharing

General

Target

f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c
Size

1.4MB
Sample

231003-zv6awshd98
MD5

f763c34a2681920ba522c88c3e983b6f
SHA1

96fb2fb7718bad220e9905b36a055befc21bcd5d
SHA256

f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c
SHA512

56997e3779715562b942df9dc36d37a7da5b55f83b6517ad456a7459be63d3f6380e30ae1315190120816732f3edadabda1210a931acdbab7f67d29a76854ad3
SSDEEP

24576:Cyr2dGBW85JZlgAT0Tcb0MVibedjYYr5YkwnyVOBOBZPNz6dim6tBq5512:pGGBWMJvLTscoMVibepr5Y3yVO0rPN5C

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c
- Size
  
  1.4MB
- MD5
  
  f763c34a2681920ba522c88c3e983b6f
- SHA1
  
  96fb2fb7718bad220e9905b36a055befc21bcd5d
- SHA256
  
  f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c
- SHA512
  
  56997e3779715562b942df9dc36d37a7da5b55f83b6517ad456a7459be63d3f6380e30ae1315190120816732f3edadabda1210a931acdbab7f67d29a76854ad3
- SSDEEP
  
  24576:Cyr2dGBW85JZlgAT0Tcb0MVibedjYYr5YkwnyVOBOBZPNz6dim6tBq5512:pGGBWMJvLTscoMVibepr5Y3yVO0rPN5C
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan