healer | a619ee2b8c850f916ba9f4ab49405ba332b3a5a7bb1ae3acd57d287138106f81 | Triage

Submit
Reports

Overview

overview

Static

static

3

a619ee2b8c...81.exe

windows7-x64

a619ee2b8c...81.exe

windows10-2004-x64

Sharing

General

Target

a619ee2b8c850f916ba9f4ab49405ba332b3a5a7bb1ae3acd57d287138106f81
Size

290KB
Sample

240321-2yrb9aef7z
MD5

5c7aaea22f808153ae63208dee1d1b9c
SHA1

2372d3e9c69ae1ccabc1f63426c2d616b9a5487e
SHA256

a619ee2b8c850f916ba9f4ab49405ba332b3a5a7bb1ae3acd57d287138106f81
SHA512

195ed3e38b95767580c30b3b3ebd4382cf2e0217923e93ccd44bdcf02b9e4eed11a4ec54e2f3e6e52c1d077c371a6d2e73b8213c0d2c3780fc7904ea5edb6b26
SSDEEP

6144:FeW4bLFYh3MgISaxenPn0sRakduR4biNZil6e4UA:Fe9hYhZa+P0WV83SlVA

Score

10^/10

healer dropper evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a619ee2b8c850f916ba9f4ab49405ba332b3a5a7bb1ae3acd57d287138106f81.exe

Resource

win7-20240221-en

healer dropper evasion trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

a619ee2b8c850f916ba9f4ab49405ba332b3a5a7bb1ae3acd57d287138106f81.exe

Resource

win10v2004-20240226-en

healer dropper evasion trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  a619ee2b8c850f916ba9f4ab49405ba332b3a5a7bb1ae3acd57d287138106f81
- Size
  
  290KB
- MD5
  
  5c7aaea22f808153ae63208dee1d1b9c
- SHA1
  
  2372d3e9c69ae1ccabc1f63426c2d616b9a5487e
- SHA256
  
  a619ee2b8c850f916ba9f4ab49405ba332b3a5a7bb1ae3acd57d287138106f81
- SHA512
  
  195ed3e38b95767580c30b3b3ebd4382cf2e0217923e93ccd44bdcf02b9e4eed11a4ec54e2f3e6e52c1d077c371a6d2e73b8213c0d2c3780fc7904ea5edb6b26
- SSDEEP
  
  6144:FeW4bLFYh3MgISaxenPn0sRakduR4biNZil6e4UA:Fe9hYhZa+P0WV83SlVA
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan

behavioral2

healerdropperevasiontrojan

© 2018-2024

Terms | Privacy