healer | 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1 | Triage

Submit
Reports

Overview

overview

Static

static

3

37dd6fe30e...b1.exe

windows7-x64

37dd6fe30e...b1.exe

windows10-2004-x64

Sharing

General

Target

37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1
Size

391KB
Sample

240424-sdvphaca52
MD5

0a84386b85b39b57e8da53f7b5db5a37
SHA1

c99c7c6739f611afa1ca9ebe723ea0b145075bac
SHA256

37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1
SHA512

3d137be1532fdfd6edce769f5c0b7c9d32aedad3ff944bca8a6f23e354962079f4889ed50d520350b2856a2e71199b4e3cab3a3ed5fa4cf4d83fba02039ee314
SSDEEP

6144:A+ISz1iadJyThR1deYrPvhIZc6c0kp5OogMqa97/QQa:Aw5rdmh3kYj5IvKp5JgMT8Qa

Score

10^/10

healer dropper evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe

Resource

win7-20240221-en

healer dropper evasion trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe

Resource

win10v2004-20240412-en

healer dropper evasion trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1
- Size
  
  391KB
- MD5
  
  0a84386b85b39b57e8da53f7b5db5a37
- SHA1
  
  c99c7c6739f611afa1ca9ebe723ea0b145075bac
- SHA256
  
  37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1
- SHA512
  
  3d137be1532fdfd6edce769f5c0b7c9d32aedad3ff944bca8a6f23e354962079f4889ed50d520350b2856a2e71199b4e3cab3a3ed5fa4cf4d83fba02039ee314
- SSDEEP
  
  6144:A+ISz1iadJyThR1deYrPvhIZc6c0kp5OogMqa97/QQa:Aw5rdmh3kYj5IvKp5JgMT8Qa
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan

behavioral2

healerdropperevasiontrojan

© 2018-2024

Terms | Privacy