healer

General

Target

bc99619b2e53bcb983b0380aeeae5b40N.cab
Size

430KB
Sample

240831-a2aecswcmr
MD5

bc99619b2e53bcb983b0380aeeae5b40
SHA1

0f0bdcd16794bd110e00d002531d07908c25f5c7
SHA256

dddb1986e75b4e018479c53776892814d67cef7bc99f2af657727502e138a06a
SHA512

39184299462344ebd864e2b42a4bb926b05f63d067f0a07b2e38da61aa4e8fcf1642a18b82c932cb506eea7e586e187ceb220752049a2c65e35aee6bc9e51637
SSDEEP

12288:3o5bbX11H7IKIHGx7pNYhoPYnBNZqGl4BEDXJ40v:SbX11b6Hu1oEGBNlVXJ40v

Score

10^/10

Malware Config

Targets

- Target
  
  s5357799.exe
- Size
  
  249KB
- MD5
  
  5a458ff788c3a84a1596d354711618bd
- SHA1
  
  beefcb258cce7f4d5f4fd988878906ecd022147f
- SHA256
  
  5a82a81ce03a53acdbf59649a463f5b382413e5be775b381b442d607157f18d4
- SHA512
  
  0cc48ee0887b8d471a449bb2aee562d6c3ed8f31c157f9c618e99948e9f4d1bbec4d38aaef1cbd77908673e424794e77e74ee96d4cb83c65b6ac59b8b725e80b
- SSDEEP
  
  6144:LTcaGEZt20ZSwbz8+Dxe8kVAOllbp7iwh8Ey:LTFzZtT78T31Riwh8Ey
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  z1247603.exe
- Size
  
  339KB
- MD5
  
  9b995acf949571a6d38b503d48a98785
- SHA1
  
  2753654bfa17386f1427956d4495e269c2178716
- SHA256
  
  e80820126f8f3d130ab9d5c681edd6908387769819e09f0a98e37f72b0e2fed1
- SHA512
  
  5decfc4cc8e40cd18dce1d956b9886f886a1e1e224bba4058f952631fada7df754d8c3d4665e884ee5aff537ebb00192a453d09e3bc912ad6740856b84740f0f
- SSDEEP
  
  6144:KEy+bnr+sp0yN90QEu2hE7ZstgFVEXwyHHOoOBlpcTQBonu/PcgFP:AMrsy90A2hE7ZsthxHux7pmYh/PPP
Score

10^/10

healer mystic discovery dropper evasion persistence stealer trojan
- Detect Mystic stealer payload
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3