healer

General

Target

c57fbdbb30a58761ea01b33960df74f0.exe
Size

2.7MB
Sample

250126-rra2kstmfz
MD5

c57fbdbb30a58761ea01b33960df74f0
SHA1

f88af9cffa88b99671a58082352e4eff7769a0c9
SHA256

df96ca0e3d7b8216b995dd1f4a2ef4d0a2426c90e8183dbe85eb0f14435d7ac0
SHA512

08672af94a7de7b1e932a98365ffc47514cdc53813409f079c765e80b53e408a50b385adb193837969198cec96fe059bf6591101161c97482c46edf6a46b6db7
SSDEEP

49152:6n/Gh87+Lz9wXxsTXJgU3txAU5ll4Dwrfvd43w9aw7/SvTTW:c17+Lz9wBsTX/mUd4DwrXC38aw7Gv

Score

10^/10

Malware Config

Targets

- Target
  
  c57fbdbb30a58761ea01b33960df74f0.exe
- Size
  
  2.7MB
- MD5
  
  c57fbdbb30a58761ea01b33960df74f0
- SHA1
  
  f88af9cffa88b99671a58082352e4eff7769a0c9
- SHA256
  
  df96ca0e3d7b8216b995dd1f4a2ef4d0a2426c90e8183dbe85eb0f14435d7ac0
- SHA512
  
  08672af94a7de7b1e932a98365ffc47514cdc53813409f079c765e80b53e408a50b385adb193837969198cec96fe059bf6591101161c97482c46edf6a46b6db7
- SSDEEP
  
  49152:6n/Gh87+Lz9wXxsTXJgU3txAU5ll4Dwrfvd43w9aw7/SvTTW:c17+Lz9wBsTX/mUd4DwrXC38aw7Gv
Score

10^/10

healer defense_evasion discovery dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2