Overview

overview

10

Static

static

3

02630c6807...38.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02630c6807b1768945982cea05183cf7bad463086ac8c49952e07341ab222438

  • Size

    697KB

  • Sample

    240507-wskpmabf49

  • MD5

    48ecd4c2c9849d8701040a3a9e2d0a67

  • SHA1

    fef7aaa0f13be6aae3fbf4ded8b2df279483ce41

  • SHA256

    02630c6807b1768945982cea05183cf7bad463086ac8c49952e07341ab222438

  • SHA512

    7df9da60e1770c095e1d13439901bb5090646b3ec9f29184c45fbc94689cc8a6d6fcf37c7379b49c5bbd752428aa5f66ec31125f5647436f98c8090320dc7246

  • SSDEEP

    12288:Sy90GG9JuAv0lM7YlCh9U755YtWQr5qh5m5RuYjEcYDRASiefezoHv:SyfGX1clerWQrsh5kuYIeSFv

Score
10/10
healerredlinezgratdropperevasioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      02630c6807b1768945982cea05183cf7bad463086ac8c49952e07341ab222438

    • Size

      697KB

    • MD5

      48ecd4c2c9849d8701040a3a9e2d0a67

    • SHA1

      fef7aaa0f13be6aae3fbf4ded8b2df279483ce41

    • SHA256

      02630c6807b1768945982cea05183cf7bad463086ac8c49952e07341ab222438

    • SHA512

      7df9da60e1770c095e1d13439901bb5090646b3ec9f29184c45fbc94689cc8a6d6fcf37c7379b49c5bbd752428aa5f66ec31125f5647436f98c8090320dc7246

    • SSDEEP

      12288:Sy90GG9JuAv0lM7YlCh9U755YtWQr5qh5m5RuYjEcYDRASiefezoHv:SyfGX1clerWQrsh5kuYIeSFv

    Score
    10/10
    healerredlinezgratdropperevasioninfostealerpersistencerattrojan

    • Detect ZGRat V1

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

    • Detects executables packed with ConfuserEx Mod

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks