healer | 180af1402708f9a667b53fbe56da060a9c3df732b99add3ce1f70472ab5c9b1d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

180af1402708f9a667b53fbe56da060a9c3df732b99add3ce1f70472ab5c9b1d
Size

1.3MB
Sample

231011-jnlpxaac4v
MD5

0230925de635a8111dd70c5accc06245
SHA1

c60873b10c9a48d34de2227584f260c1a2b5cf0d
SHA256

180af1402708f9a667b53fbe56da060a9c3df732b99add3ce1f70472ab5c9b1d
SHA512

911fbd05276c2e98735fa47fe12aaeeded5eec9b3b4e1670e8c734ad6772bc50c8500fde56efc521cb1926bec954fb1ddedcc4ef04685edb5dfe3696d8fbf90c
SSDEEP

24576:WyHBVRUEV7SWxUXAra2lDgMGaHLE+z6iqTNcOgsm+WmpJoTrkTSpeSv:lLGEV7A2xGar+iqTNfvFpJoCj

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  180af1402708f9a667b53fbe56da060a9c3df732b99add3ce1f70472ab5c9b1d
- Size
  
  1.3MB
- MD5
  
  0230925de635a8111dd70c5accc06245
- SHA1
  
  c60873b10c9a48d34de2227584f260c1a2b5cf0d
- SHA256
  
  180af1402708f9a667b53fbe56da060a9c3df732b99add3ce1f70472ab5c9b1d
- SHA512
  
  911fbd05276c2e98735fa47fe12aaeeded5eec9b3b4e1670e8c734ad6772bc50c8500fde56efc521cb1926bec954fb1ddedcc4ef04685edb5dfe3696d8fbf90c
- SSDEEP
  
  24576:WyHBVRUEV7SWxUXAra2lDgMGaHLE+z6iqTNcOgsm+WmpJoTrkTSpeSv:lLGEV7A2xGar+iqTNfvFpJoCj
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan

behavioral2