healer | 4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a | Triage

Sharing

General

Target

4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a
Size

1.0MB
Sample

231012-dbzhcade57
MD5

57d3c4401d3486b76c0ecb4c2ad1082d
SHA1

b60692c701b95bce619cdd9ae868cd46e37a2268
SHA256

4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a
SHA512

1da09f62f4ad6a4449e451cee34788361a156990972ef6764c2ca080ef8c7fe07f0ce5d710c47c687d10d365b7d6ecb099f0e3dc628ee546654070cbab347bac
SSDEEP

24576:XyZjdiK4Qis65bdkqXsqiDs7/vpmzpz7koLgGfqli:i67Qis0baqXsqp7/vp27PgGil

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a
- Size
  
  1.0MB
- MD5
  
  57d3c4401d3486b76c0ecb4c2ad1082d
- SHA1
  
  b60692c701b95bce619cdd9ae868cd46e37a2268
- SHA256
  
  4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a
- SHA512
  
  1da09f62f4ad6a4449e451cee34788361a156990972ef6764c2ca080ef8c7fe07f0ce5d710c47c687d10d365b7d6ecb099f0e3dc628ee546654070cbab347bac
- SSDEEP
  
  24576:XyZjdiK4Qis65bdkqXsqiDs7/vpmzpz7koLgGfqli:i67Qis0baqXsqp7/vp27PgGil
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan

behavioral2

healerdropperevasionpersistencetrojan