healer | c86839815d01abe72d7176a985bece846724409453d19c6d6d0978d89a07e98c | Triage

Sharing

General

Target

NEAS.f53a98f06fe1d974a2bdba44efee8d50.exe
Size

491KB
Sample

231106-cxvwlshe66
MD5

f53a98f06fe1d974a2bdba44efee8d50
SHA1

a4933df2002645169bf956ae6b5f656e77e30576
SHA256

c86839815d01abe72d7176a985bece846724409453d19c6d6d0978d89a07e98c
SHA512

832c3b7055f32773ae87343e3b9ad1af1559dc1453e2594dcedc0acdff0400083508473a3af52eb802cfa68e8c87768d611980fb96d0c8aa9b146e554adb137a
SSDEEP

12288:ZMrwy901uXbQFtUfYFktimfq2ZbGtTPyqFDbJZz:tyyUYqwhdtTPyEDdt

Score

10^/10

healer mystic dropper evasion persistence stealer trojan

Malware Config

Targets

- Target
  
  NEAS.f53a98f06fe1d974a2bdba44efee8d50.exe
- Size
  
  491KB
- MD5
  
  f53a98f06fe1d974a2bdba44efee8d50
- SHA1
  
  a4933df2002645169bf956ae6b5f656e77e30576
- SHA256
  
  c86839815d01abe72d7176a985bece846724409453d19c6d6d0978d89a07e98c
- SHA512
  
  832c3b7055f32773ae87343e3b9ad1af1559dc1453e2594dcedc0acdff0400083508473a3af52eb802cfa68e8c87768d611980fb96d0c8aa9b146e554adb137a
- SSDEEP
  
  12288:ZMrwy901uXbQFtUfYFktimfq2ZbGtTPyqFDbJZz:tyyUYqwhdtTPyEDdt
Score

10^/10

healer mystic dropper evasion persistence stealer trojan
- Detect Mystic stealer payload
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healermysticdropperevasionpersistencestealertrojan