healer

General

Target

21997981323.zip
Size

1.7MB
Sample

250417-w12ywaznw7
MD5

5c28b865230811799f234fb65acb2f8c
SHA1

d2da510a2a7f8291dd0aeadc8ce46cef74c35e49
SHA256

ac30fb256eba54793a7b7c78e22bef60f92906ac70472125a12912abc9d0628f
SHA512

d3693fac56978580f42752d388d8bdb3241e024142b48725ef6925924c7a237012c97cb494e2ced2c3c1f49edd12cd9c21f6c642e13373dead998bd66cd7838f
SSDEEP

49152:viAIXUS7H3k+8/3/q4dQ+UXV+33BmscMV:viAIp7Xk+6PqCQ+gg3YUV

Score

10^/10

Malware Config

Targets

- Target
  
  0477084ff821bcaedeb54e50af909ba33ed6a1c5fe711f44c3923753bbb47854
- Size
  
  1.7MB
- MD5
  
  f79b7b1e6fd2d4d9597af548188a29ae
- SHA1
  
  b318a3b417fa61986633972a3e698f89274f4d66
- SHA256
  
  0477084ff821bcaedeb54e50af909ba33ed6a1c5fe711f44c3923753bbb47854
- SHA512
  
  59cee75a7e2d261865eebabe963a4579cc8112f369ef26bd450afe5f03c8f342630ebae29e6ab6186d9dce62547aa4c725cc83ed5b1214be611e3429b838a9eb
- SSDEEP
  
  24576:j5HsEPnYzwo6DwZ3HJy+ugJiqW4OkS8yan/OOgO53SrEVRvv3aDNbVe7eC+MDRXN:VsleMZ3p6IShEgi6EfH3iulDRic
Score

10^/10

healer defense_evasion discovery dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Healer family
  healer
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2