Overview

overview

10

Static

static

3

660cd93864...ec.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    660cd93864059f23653b20035ddf65ca8ab2a6b7955845956e3ac0bdbbcd28ec

  • Size

    765KB

  • Sample

    240421-2g23esce2x

  • MD5

    96a5cea23c1716449eb15f99d93edfec

  • SHA1

    66f58e9b63aeedfc3164a127997c6be833920146

  • SHA256

    660cd93864059f23653b20035ddf65ca8ab2a6b7955845956e3ac0bdbbcd28ec

  • SHA512

    2b76e77439f2d9036065a54e18666fb9f7ad92683deb1f8816bfd28bd3c9df3e1d31b9a3118b1ff91a29656155401709bfafb1e3e25510b6fa4587a275fc9e1d

  • SSDEEP

    12288:dy90HSrtyuZkQ0VyqZnkcPU8wft/fNzIVoGp0rmi/biJg82aBeqpri6W6Q39:dyWSrtyu2Q0VtdnUhFNzIVoWqmiTMgOS

Score
10/10
healerredlinezgratdropperevasioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      660cd93864059f23653b20035ddf65ca8ab2a6b7955845956e3ac0bdbbcd28ec

    • Size

      765KB

    • MD5

      96a5cea23c1716449eb15f99d93edfec

    • SHA1

      66f58e9b63aeedfc3164a127997c6be833920146

    • SHA256

      660cd93864059f23653b20035ddf65ca8ab2a6b7955845956e3ac0bdbbcd28ec

    • SHA512

      2b76e77439f2d9036065a54e18666fb9f7ad92683deb1f8816bfd28bd3c9df3e1d31b9a3118b1ff91a29656155401709bfafb1e3e25510b6fa4587a275fc9e1d

    • SSDEEP

      12288:dy90HSrtyuZkQ0VyqZnkcPU8wft/fNzIVoGp0rmi/biJg82aBeqpri6W6Q39:dyWSrtyu2Q0VtdnUhFNzIVoWqmiTMgOS

    Score
    10/10
    healerredlinezgratdropperevasioninfostealerpersistencerattrojan

    • Detect ZGRat V1

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

    • Detects executables packed with ConfuserEx Mod

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks