Overview

overview

10

Static

static

3

874f011836...KI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    874f0118364b3b6a779c152eef6a80d0_NEIKI

  • Size

    828KB

  • Sample

    240508-nmqppacg83

  • MD5

    874f0118364b3b6a779c152eef6a80d0

  • SHA1

    682a22a08a05b309bfe80a4894e93de0d892c6e3

  • SHA256

    02c468753c3abc1ed70a55f0cdede5c47b32a80c068348be67471e5e1d88104c

  • SHA512

    10670d9e51d3fff3c91facd3f6fa6bcf1d165156364134a77863626dfcb8a3dba6772dd8388d80417f6eb78598b9a6c689187e45f4f9470286bc23a0a0506642

  • SSDEEP

    24576:Ny+vejioKutJaKLrDRqb8gA6butMvZxRPp:onjiohrrNo57F

Score
10/10
healerredlinezgratdropperevasioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      874f0118364b3b6a779c152eef6a80d0_NEIKI

    • Size

      828KB

    • MD5

      874f0118364b3b6a779c152eef6a80d0

    • SHA1

      682a22a08a05b309bfe80a4894e93de0d892c6e3

    • SHA256

      02c468753c3abc1ed70a55f0cdede5c47b32a80c068348be67471e5e1d88104c

    • SHA512

      10670d9e51d3fff3c91facd3f6fa6bcf1d165156364134a77863626dfcb8a3dba6772dd8388d80417f6eb78598b9a6c689187e45f4f9470286bc23a0a0506642

    • SSDEEP

      24576:Ny+vejioKutJaKLrDRqb8gA6butMvZxRPp:onjiohrrNo57F

    Score
    10/10
    healerredlinezgratdropperevasioninfostealerpersistencerattrojan

    • Detect ZGRat V1

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks