healer | b1f32f0f87a005e43c6e2a02991c465234987aa76046e5a5002714a50098f08f | Triage

Submit
Reports

Overview

overview

Static

static

3

b1f32f0f87...8f.exe

windows7-x64

b1f32f0f87...8f.exe

windows10-2004-x64

Sharing

General

Target

b1f32f0f87a005e43c6e2a02991c465234987aa76046e5a5002714a50098f08f
Size

395KB
Sample

240504-cabjfsdc65
MD5

f6d3bde91b1c282fd96d3f7df1d5380b
SHA1

be0fb279096517370ec8dea3dc265dfc15bba339
SHA256

b1f32f0f87a005e43c6e2a02991c465234987aa76046e5a5002714a50098f08f
SHA512

69da93d65f460074a729050288bfc48cb330c22bded63fdd094d43267f0efa1327a58457abb74979d0a98ddd4e98613e102c5d77093be0b5bb2cc831c61d8bb0
SSDEEP

3072:WqzpJDoNNml840wdcWz1/NSnwNGY2u+46kF0+Mc7u910CwEBhd+B9PfUD5/myu:lzL28xdckCAGYVd7uX0a9Sfq

Score

10^/10

healer dropper evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b1f32f0f87a005e43c6e2a02991c465234987aa76046e5a5002714a50098f08f.exe

Resource

win7-20240215-en

healer dropper evasion trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

b1f32f0f87a005e43c6e2a02991c465234987aa76046e5a5002714a50098f08f.exe

Resource

win10v2004-20240419-en

healer dropper evasion trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  b1f32f0f87a005e43c6e2a02991c465234987aa76046e5a5002714a50098f08f
- Size
  
  395KB
- MD5
  
  f6d3bde91b1c282fd96d3f7df1d5380b
- SHA1
  
  be0fb279096517370ec8dea3dc265dfc15bba339
- SHA256
  
  b1f32f0f87a005e43c6e2a02991c465234987aa76046e5a5002714a50098f08f
- SHA512
  
  69da93d65f460074a729050288bfc48cb330c22bded63fdd094d43267f0efa1327a58457abb74979d0a98ddd4e98613e102c5d77093be0b5bb2cc831c61d8bb0
- SSDEEP
  
  3072:WqzpJDoNNml840wdcWz1/NSnwNGY2u+46kF0+Mc7u910CwEBhd+B9PfUD5/myu:lzL28xdckCAGYVd7uX0a9Sfq
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan

behavioral2

healerdropperevasiontrojan

© 2018-2025

Terms | Privacy