healer | c0d2e029ff8df21de5e3bc7e055bd8db4901017bba06f4ee7c345e9c8a683cf3 | Triage™

Login
Reports

Overview

overview

Static

static

3

c0d2e029ff...f3.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
c0d2e029ff8df21de5e3bc7e055bd8db4901017bba06f4ee7c345e9c8a683cf3.exe
Size 338KB
Sample241113-v82gmswerf
SHA256 c0d2e029ff8df21de5e3bc7e055bd8db4901017bba06f4ee7c345e9c8a683cf3
MD5 f02751df81dd45565e26fe25e5403799
SHA1 cadeb351dca442c6af9e44907c47f2001cd1738e
SHA512 4053f17a443c0e28aece17b3161a846f1bbc7bce424c0e044a5edac8e12e6b6565c790f678e52ed6965b0d026e31ece34bc35b4be5f93631a8221a34167fafe9
SSDEEP 6144:KKy+bnr+Ep0yN90QEWX3eH5V15j3sOUYMLkxJg5WxNglmR7D8ZG:eMrcy90iOHf3sOUYMwpxNHhDUG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer discovery dropper evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c0d2e029ff8df21de5e3bc7e055bd8db4901017bba06f4ee7c345e9c8a683cf3.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

12 signatures

120 seconds

healer discovery dropper evasion persistence trojan

Malware Config

Targets

- Target
  c0d2e029ff8df21de5e3bc7e055bd8db4901017bba06f4ee7c345e9c8a683cf3.exe
- Size 338KB
- SHA256 c0d2e029ff8df21de5e3bc7e055bd8db4901017bba06f4ee7c345e9c8a683cf3
- MD5 f02751df81dd45565e26fe25e5403799
- SHA1 cadeb351dca442c6af9e44907c47f2001cd1738e
- SHA512 4053f17a443c0e28aece17b3161a846f1bbc7bce424c0e044a5edac8e12e6b6565c790f678e52ed6965b0d026e31ece34bc35b4be5f93631a8221a34167fafe9
- SSDEEP 6144:KKy+bnr+Ep0yN90QEWX3eH5V15j3sOUYMLkxJg5WxNglmR7D8ZG:eMrcy90iOHf3sOUYMwpxNHhDUG
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

healer discovery dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdiscoverydropperevasionpersistencetrojan

© 2018-2026

Terms | Privacy