Overview

overview

10

Static

static

3

26274fe67b...76.exe

windows7-x64

10

26274fe67b...76.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    26274fe67b8533068c77b7ab5af38976.exe

  • Size

    1.1MB

  • Sample

    231011-n97lqaea41

  • MD5

    26274fe67b8533068c77b7ab5af38976

  • SHA1

    0d26933a593c4329006e5e3b7685f747f87c6e3f

  • SHA256

    c241af3fd9eba3f52028a34a84ce8654a8240779dee7a6579c6e658391379dab

  • SHA512

    33d48cb553fb022316e7bb7c42b0298f43c0f1c6c9a40550d9ba87050137d5b706397cbc31ad52ec8fdee2a90da2e71cfc94091d44f6b0bc908f9a17f5a529fe

  • SSDEEP

    24576:qyrGGvIIhhYElXPjNecSYbp33HdnMSeAOtyGPr9MEQj68epVVHzuln4:xrbvIah3VPjNmYNHHdnNLO1MNj68eJSh

Score
10/10
healerdropperevasionpersistencetrojan

Malware Config

Targets

    • Target

      26274fe67b8533068c77b7ab5af38976.exe

    • Size

      1.1MB

    • MD5

      26274fe67b8533068c77b7ab5af38976

    • SHA1

      0d26933a593c4329006e5e3b7685f747f87c6e3f

    • SHA256

      c241af3fd9eba3f52028a34a84ce8654a8240779dee7a6579c6e658391379dab

    • SHA512

      33d48cb553fb022316e7bb7c42b0298f43c0f1c6c9a40550d9ba87050137d5b706397cbc31ad52ec8fdee2a90da2e71cfc94091d44f6b0bc908f9a17f5a529fe

    • SSDEEP

      24576:qyrGGvIIhhYElXPjNecSYbp33HdnMSeAOtyGPr9MEQj68epVVHzuln4:xrbvIah3VPjNmYNHHdnNLO1MNj68eJSh

    Score
    10/10
    healerdropperevasionpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks