healer

General

Target

a236d1d48df7c0818ada17aa0a13bc7840e6d375ff2ebd8e2cd134aa66723b6b
Size

1.7MB
Sample

250125-enqawavmg1
MD5

17e9154394492466aa7d1e0c39f77c96
SHA1

ddfbd2446bc71e51626808463e39cea2328d91f6
SHA256

a236d1d48df7c0818ada17aa0a13bc7840e6d375ff2ebd8e2cd134aa66723b6b
SHA512

39a8370ca50eaf8ac1184c0789cbe62ac925d633d87a2475dc20f78f7b2d35a07820737e0d409f43a44356dd399d6bbf78b2bb66fa9b2d0df2afd6dfd22d69dd
SSDEEP

49152:/GeO1L3GAoFZv86Gtht6iXBgazXRdOX/o5d:/GjGx06I6iXmsLO/

Score

10^/10

Malware Config

Targets

- Target
  
  a236d1d48df7c0818ada17aa0a13bc7840e6d375ff2ebd8e2cd134aa66723b6b
- Size
  
  1.7MB
- MD5
  
  17e9154394492466aa7d1e0c39f77c96
- SHA1
  
  ddfbd2446bc71e51626808463e39cea2328d91f6
- SHA256
  
  a236d1d48df7c0818ada17aa0a13bc7840e6d375ff2ebd8e2cd134aa66723b6b
- SHA512
  
  39a8370ca50eaf8ac1184c0789cbe62ac925d633d87a2475dc20f78f7b2d35a07820737e0d409f43a44356dd399d6bbf78b2bb66fa9b2d0df2afd6dfd22d69dd
- SSDEEP
  
  49152:/GeO1L3GAoFZv86Gtht6iXBgazXRdOX/o5d:/GjGx06I6iXmsLO/
Score

10^/10

healer defense_evasion discovery dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2