healer | b74a498bb5f6e584e843e22186c25628e7a99618aedad1f4591eeb281e65928d | Triage

Submit
Reports

Overview

overview

Static

static

3

b74a498bb5...8d.exe

windows7-x64

b74a498bb5...8d.exe

windows10-2004-x64

Sharing

General

Target

b74a498bb5f6e584e843e22186c25628e7a99618aedad1f4591eeb281e65928d
Size

259KB
Sample

240501-cyf4vafh44
MD5

a19dcb9346ac053faf0fce3c04243ccc
SHA1

64d68190051a952a8ff34eef787ffdb3b281a88f
SHA256

b74a498bb5f6e584e843e22186c25628e7a99618aedad1f4591eeb281e65928d
SHA512

e666ed56ba0bc9bcb6dd82ce89404dc7d4dd9629ad3fae2bb75ccdc8a59666305318a2c02e99bfedaff7091204d23fa2b7254efe1a72cf4c6f4bd7cec4affdc8
SSDEEP

3072:EQyJn+7EuQKTqpv9f9jgn6G1hL4AS2OkOhlUEArocsFFs2uxoplbdPaKDv9y3L5o:V4n+7CKo9f9sTH4kOk6ArockNQKJbW

Score

10^/10

healer dropper evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b74a498bb5f6e584e843e22186c25628e7a99618aedad1f4591eeb281e65928d.exe

Resource

win7-20240221-en

healer dropper evasion trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

b74a498bb5f6e584e843e22186c25628e7a99618aedad1f4591eeb281e65928d.exe

Resource

win10v2004-20240419-en

healer dropper evasion trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  b74a498bb5f6e584e843e22186c25628e7a99618aedad1f4591eeb281e65928d
- Size
  
  259KB
- MD5
  
  a19dcb9346ac053faf0fce3c04243ccc
- SHA1
  
  64d68190051a952a8ff34eef787ffdb3b281a88f
- SHA256
  
  b74a498bb5f6e584e843e22186c25628e7a99618aedad1f4591eeb281e65928d
- SHA512
  
  e666ed56ba0bc9bcb6dd82ce89404dc7d4dd9629ad3fae2bb75ccdc8a59666305318a2c02e99bfedaff7091204d23fa2b7254efe1a72cf4c6f4bd7cec4affdc8
- SSDEEP
  
  3072:EQyJn+7EuQKTqpv9f9jgn6G1hL4AS2OkOhlUEArocsFFs2uxoplbdPaKDv9y3L5o:V4n+7CKo9f9sTH4kOk6ArockNQKJbW
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan

behavioral2

healerdropperevasiontrojan

© 2018-2024

Terms | Privacy