healer

General

Target

2319ec7a1df14b6ccb33e2ca746ea10448abaff03f44661da43512bfe4cabf9e
Size

1.7MB
Sample

250125-js5nksvmgq
MD5

4f62ac0c591819db6db4082040ad42f2
SHA1

699e409298ca0aff5d54478c0f9f0f3ce9b91892
SHA256

2319ec7a1df14b6ccb33e2ca746ea10448abaff03f44661da43512bfe4cabf9e
SHA512

c3d2fbe7d65875c656c37a2fa90be9ed1afc4722292e5a779323febbd0731010ef56ac4a49b9c6c6c9dd6232c8b291a1bf6c4291dbaa6a7224fce2aacbd89dad
SSDEEP

24576:MtRJvCicznKa8tg2SzQWT12e+eSpDso5QNvzwy5FMb6Q9CGwBHCHfS0aSR:MtRJvC50WT1YeSnQjPMb10PBHoSI

Score

10^/10

Malware Config

Targets

- Target
  
  2319ec7a1df14b6ccb33e2ca746ea10448abaff03f44661da43512bfe4cabf9e
- Size
  
  1.7MB
- MD5
  
  4f62ac0c591819db6db4082040ad42f2
- SHA1
  
  699e409298ca0aff5d54478c0f9f0f3ce9b91892
- SHA256
  
  2319ec7a1df14b6ccb33e2ca746ea10448abaff03f44661da43512bfe4cabf9e
- SHA512
  
  c3d2fbe7d65875c656c37a2fa90be9ed1afc4722292e5a779323febbd0731010ef56ac4a49b9c6c6c9dd6232c8b291a1bf6c4291dbaa6a7224fce2aacbd89dad
- SSDEEP
  
  24576:MtRJvCicznKa8tg2SzQWT12e+eSpDso5QNvzwy5FMb6Q9CGwBHCHfS0aSR:MtRJvC50WT1YeSnQjPMb10PBHoSI
Score

10^/10

healer defense_evasion discovery dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2