healer | 31a0f98c37f0acc09888796e5a3829ee1478723d2005a67d531c13c9d419937a | Triage

Sharing

General

Target

811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe
Size

217KB
Sample

240531-1qgmeafe82
MD5

811f66fa14f932f74f348ec0471cf030
SHA1

45e99adf9a858d66bc4f9711664f554c7645e965
SHA256

31a0f98c37f0acc09888796e5a3829ee1478723d2005a67d531c13c9d419937a
SHA512

064808e14a1ed0878b8fca3002f458716b32c45706d128e6f3c5af78b299341b0b8ceded00a5be91d40af977adb08d648d03a8f8c540bc64ec3e447e371f76fd
SSDEEP

6144:KSy+bnr+Op0yN90QEzsUl1Xs93Le+Ixlh7:uMryy90ZsUc93LylB

Score

10^/10

healer mystic dropper evasion persistence stealer trojan

Malware Config

Targets

- Target
  
  811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe
- Size
  
  217KB
- MD5
  
  811f66fa14f932f74f348ec0471cf030
- SHA1
  
  45e99adf9a858d66bc4f9711664f554c7645e965
- SHA256
  
  31a0f98c37f0acc09888796e5a3829ee1478723d2005a67d531c13c9d419937a
- SHA512
  
  064808e14a1ed0878b8fca3002f458716b32c45706d128e6f3c5af78b299341b0b8ceded00a5be91d40af977adb08d648d03a8f8c540bc64ec3e447e371f76fd
- SSDEEP
  
  6144:KSy+bnr+Op0yN90QEzsUl1Xs93Le+Ixlh7:uMryy90ZsUc93LylB
Score

10^/10

healer mystic dropper evasion persistence stealer trojan
- Detect Mystic stealer payload
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healermysticdropperevasionpersistencestealertrojan