healer

General

Target

85d2dba3e1c9d0b4fa2cdf617091e9161e5976fc49342c48c5430b6c8901e463
Size

1.7MB
Sample

250125-v4htqstje1
MD5

a863b374843aee46f9aa4601f3eb70b8
SHA1

9f3d3dd8f5b5c0f4592f6ebbfdeddac225384411
SHA256

85d2dba3e1c9d0b4fa2cdf617091e9161e5976fc49342c48c5430b6c8901e463
SHA512

79ca00e974a0d9111e21acf31fe08217af7b0abbdcdde823c7dd698ca98a35539b761b5ce4e2f809221c3d1403035a1ffcaed5364745cd3d5bd040b6b55f865a
SSDEEP

24576:4UAbEYJ3681Z4vqrKox4yWMua6NUaBQpXm4EM+lSQqjknZqK2JpE+MSHtOPUK6bV:451684IxCyhT1EMWnsEJwbcxCPx

Score

10^/10

Malware Config

Targets

- Target
  
  85d2dba3e1c9d0b4fa2cdf617091e9161e5976fc49342c48c5430b6c8901e463
- Size
  
  1.7MB
- MD5
  
  a863b374843aee46f9aa4601f3eb70b8
- SHA1
  
  9f3d3dd8f5b5c0f4592f6ebbfdeddac225384411
- SHA256
  
  85d2dba3e1c9d0b4fa2cdf617091e9161e5976fc49342c48c5430b6c8901e463
- SHA512
  
  79ca00e974a0d9111e21acf31fe08217af7b0abbdcdde823c7dd698ca98a35539b761b5ce4e2f809221c3d1403035a1ffcaed5364745cd3d5bd040b6b55f865a
- SSDEEP
  
  24576:4UAbEYJ3681Z4vqrKox4yWMua6NUaBQpXm4EM+lSQqjknZqK2JpE+MSHtOPUK6bV:451684IxCyhT1EMWnsEJwbcxCPx
Score

10^/10

healer defense_evasion discovery dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2