healer | 9a15f96a2bb17e58e15e1028f4d3171e28e7bf44d551abcbee1adf93dd006237 | Triage

Sharing

General

Target

9a15f96a2bb17e58e15e1028f4d3171e28e7bf44d551abcbee1adf93dd006237.exe
Size

554KB
Sample

241118-xanh8sxnbn
MD5

9142cbd09e8ced79ae92f7f36295dacb
SHA1

43ac6b24106beac4c82d23a93f27d2a56e4fb336
SHA256

9a15f96a2bb17e58e15e1028f4d3171e28e7bf44d551abcbee1adf93dd006237
SHA512

4613a8433e1e02599ad21571152ceba6db2cfd51716289d4fb5f1dd802b4c1572c0cf638b039c6a0df47ce8bd7fdac11da270df25da34b44caf31c5acb09fec7
SSDEEP

12288:qy90YmrpSmIwi/42zKWtTK3AFDdnS3GNX3GPbIJUO/OjkrC1+Vxb:qyGrzidtPDnJv/LWaxb

Score

10^/10

healer discovery dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  9a15f96a2bb17e58e15e1028f4d3171e28e7bf44d551abcbee1adf93dd006237.exe
- Size
  
  554KB
- MD5
  
  9142cbd09e8ced79ae92f7f36295dacb
- SHA1
  
  43ac6b24106beac4c82d23a93f27d2a56e4fb336
- SHA256
  
  9a15f96a2bb17e58e15e1028f4d3171e28e7bf44d551abcbee1adf93dd006237
- SHA512
  
  4613a8433e1e02599ad21571152ceba6db2cfd51716289d4fb5f1dd802b4c1572c0cf638b039c6a0df47ce8bd7fdac11da270df25da34b44caf31c5acb09fec7
- SSDEEP
  
  12288:qy90YmrpSmIwi/42zKWtTK3AFDdnS3GNX3GPbIJUO/OjkrC1+Vxb:qyGrzidtPDnJv/LWaxb
Score

10^/10

healer discovery dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdiscoverydropperevasionpersistencetrojan