Overview

overview

10

Static

static

3

0b20d57e6e...e2.exe

windows7-x64

10

0b20d57e6e...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b20d57e6eba7b7ddfe47747cc550966316ef277fc2a907af877edd6892b32e2

  • Size

    1.7MB

  • Sample

    250125-gvzh8s1lbl

  • MD5

    e9f76b24a0fd3744959c695d9fd94a72

  • SHA1

    c367b9328d631579bef9cf704ddf0e386aee0139

  • SHA256

    0b20d57e6eba7b7ddfe47747cc550966316ef277fc2a907af877edd6892b32e2

  • SHA512

    0be8189e21f585d9971833917c40a2fc66694b3ad32bb6d3918660a1ed8ed7a4fb5e08ded766d1ff80b14a7c4690e9c48b1a53233f970590c5c819eca80e2aec

  • SSDEEP

    24576:sIUsq5A64bt0FKqHjWNnqbVIlPI3Ct0vu9FLH5uoUmc6DSLzd7gB3vFb4in:sIUslLRxKqaINt0vuFTUQSuyin

Score
10/10
healerdefense_evasiondiscoverydropperevasiontrojan

Malware Config

Targets

    • Target

      0b20d57e6eba7b7ddfe47747cc550966316ef277fc2a907af877edd6892b32e2

    • Size

      1.7MB

    • MD5

      e9f76b24a0fd3744959c695d9fd94a72

    • SHA1

      c367b9328d631579bef9cf704ddf0e386aee0139

    • SHA256

      0b20d57e6eba7b7ddfe47747cc550966316ef277fc2a907af877edd6892b32e2

    • SHA512

      0be8189e21f585d9971833917c40a2fc66694b3ad32bb6d3918660a1ed8ed7a4fb5e08ded766d1ff80b14a7c4690e9c48b1a53233f970590c5c819eca80e2aec

    • SSDEEP

      24576:sIUsq5A64bt0FKqHjWNnqbVIlPI3Ct0vu9FLH5uoUmc6DSLzd7gB3vFb4in:sIUslLRxKqaINt0vuFTUQSuyin

    Score
    10/10
    healerdefense_evasiondiscoverydropperevasiontrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Modifies Windows Defender notification settings

      defense_evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Windows security modification

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks