healer

General

Target

6b3da5ffa79ec3c9e79fc9eedad48270780f9e57c1296157d4c59a0b94dfed57N.exe
Size

2.8MB
Sample

250208-qa3vlawnfw
MD5

32fa033c1eb152f02dc180e4aef59ac0
SHA1

1788a4e5019d82bf521ddcc55d1a2e381a2b8a79
SHA256

6b3da5ffa79ec3c9e79fc9eedad48270780f9e57c1296157d4c59a0b94dfed57
SHA512

a33366f8b035766fb9016ab12337a4b990b7eb0228a63662b0388ad8fbcc4ad6043ed144838202e821a6e36dff28e5fb0aba4c8072984ffc7c357e71267f7613
SSDEEP

49152:uZyTMoMf/ZbIMNEbBC06DQ/HOAXX6FVqaIIy4lLlfwBjaTO:uZyTnW/ZbIMNEbBC06DQ/HOoGAaISlLh

Score

10^/10

Malware Config

Targets

- Target
  
  6b3da5ffa79ec3c9e79fc9eedad48270780f9e57c1296157d4c59a0b94dfed57N.exe
- Size
  
  2.8MB
- MD5
  
  32fa033c1eb152f02dc180e4aef59ac0
- SHA1
  
  1788a4e5019d82bf521ddcc55d1a2e381a2b8a79
- SHA256
  
  6b3da5ffa79ec3c9e79fc9eedad48270780f9e57c1296157d4c59a0b94dfed57
- SHA512
  
  a33366f8b035766fb9016ab12337a4b990b7eb0228a63662b0388ad8fbcc4ad6043ed144838202e821a6e36dff28e5fb0aba4c8072984ffc7c357e71267f7613
- SSDEEP
  
  49152:uZyTMoMf/ZbIMNEbBC06DQ/HOAXX6FVqaIIy4lLlfwBjaTO:uZyTnW/ZbIMNEbBC06DQ/HOoGAaISlLh
Score

10^/10

healer defense_evasion discovery dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2