MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83d13148266096e7e7055fdbc7f98d2f9ce60684e26e9de9660f7d7e5c206e50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Healer


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83d13148266096e7e7055fdbc7f98d2f9ce60684e26e9de9660f7d7e5c206e50
SHA3-384 hash: 7723015730a1b7c91e8438b8717ec1c56bf4ae3d449bf94294ae3b5bd133a46cea8ccd2b31730b9c2b3216fdf4b9b3c5
SHA1 hash: dd97eea14bece5cd043e7fd582c69be7ef0af17a
MD5 hash: e3781317a4f73da5febd0737219d4501
humanhash: burger-wyoming-ack-cola
File name:e3781317a4f73da5febd0737219d4501
Download: download sample
Signature Healer
Create hunting rule
File size:1'763'840 bytes
First seen:2024-02-19 12:44:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash baa93d47220682c04d92f7797d9224ce (139 x RiseProStealer, 26 x Xtrat, 18 x CoinMiner)
ssdeep 49152:3kp1T0pn6D783K0ctdvgfJaJ6bqwm4FM+Lb:Up1T0pn843K0ctdIfkJGG+Lb
Threatray 69 similar samples on MalwareBazaar
TLSH T1CB8533E80C6A710AC086EBF5ABF94B77A69C42A5B1D8C7C5DDA4C01B2783313B74DC51
TrID 52.9% (.EXE) Win32 Executable (generic) (4504/4/1)
23.5% (.EXE) Generic Win/DOS Executable (2002/3)
23.5% (.EXE) DOS Executable Generic (2000/1)
Reporter zbetcheckin
Tags:32 exe Healer

Intelligence

File Origin
# of uploads :
1
# of downloads :
423
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/476804/
Detection(s):
Win.Packed.Zusy-10021181-0
Create hunting rule

Win.Packed.Misc-10021254-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Launching a service
Creating a file
Blocking the Windows Defender launch
Disabling the operating system update service
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed packed themidawinlicense
Link:
https://www.filescan.io/uploads/65d34d5603a1c3a7aef16dfd/reports/0662e314-d9b9-4b34-a0c4-41d0389f3933/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/83d13148266096e7e7055fdbc7f98d2f9ce60684e26e9de9660f7d7e5c206e50
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/25ac76ec-466f-4fbf-8314-e999297b677a
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1394538
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/83d13148266096e7e7055fdbc7f98d2f9ce60684e26e9de9660f7d7e5c206e50
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/83d13148266096e7e7055fdbc7f98d2f9ce60684e26e9de9660f7d7e5c206e50/
Threat name:
Win32.Spyware.Risepro
Create hunting rule
Status:
Malicious
First seen:
2024-02-19 12:45:07 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 24 (87.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qpitcsbgmclopzyfl7n4p6mnf6oombue4jxj32lgb56x4xbanzia._file
Verdict:
malicious
Similar samples:
0c9481b1399d0d2148ee3be59c77d0d9a7e508c747d253c3c1a29f7bc9579eee
Healer
13450b40b89b4d197d956e39d0242ed84bdb17c2161643ba29bde8e6d31a321f
Healer
3fd6911a2df871f06a8c7a0fb7e86ca5d785b989203aae724c8c19457ba43098
Healer
6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17
Healer
b4bbdadeb876d22140beabe77e143cd74871461c0823f9f9ba79b41106386d26
Healer
c694df19f3adbff42dfd39385d7b67c390da14f3b24d0cf6a346df05dfb07d15
Healer
c8d6c1588291d1c74901758f749a744f9785efabceb77083651aa522cf732e3a
Healer
de5dad99d072f740e2ccef4d7f2ea2b4b909dd378b954d189e8fbfdb6222ee8b
Healer
ede914d1d1c128dd80e5c4cd718df12f17b4d3e5fdc7ab060e36e310d66d061c
Healer
f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4
Healer
+ 59 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/240219-py23jadc7y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Windows security modification
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
83d13148266096e7e7055fdbc7f98d2f9ce60684e26e9de9660f7d7e5c206e50
MD5 hash:
e3781317a4f73da5febd0737219d4501
SHA1 hash:
dd97eea14bece5cd043e7fd582c69be7ef0af17a
Link:
https://www.unpac.me/results/339f2f14-d214-4db1-a294-978790ede86c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/83d131482660/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/83d13148266096e7e7055fdbc7f98d2f9ce60684e26e9de9660f7d7e5c206e50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Healer

Executable exe 83d13148266096e7e7055fdbc7f98d2f9ce60684e26e9de9660f7d7e5c206e50

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/476804/
  
URLhaus
https://urlhaus.abuse.ch/url/2760429/
  
URLhaus
https://urlhaus.abuse.ch/url/2764551/

Comments


Avatar
zbet commented on 2024-02-19 12:44:18 UTC

url : hxxp://185.215.113.46/cost/niks.exe