Overview

overview

10

Static

static

3

2bbc63f4ce...cd.exe

windows7-x64

10

2bbc63f4ce...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2bbc63f4cebba314039bada0257840c6e37d56bc1d9da2e5fdc347c69fb68dcd

  • Size

    2.6MB

  • Sample

    250126-pf3lca1mat

  • MD5

    8d305968f84066b22797cd223f0ea043

  • SHA1

    379225ae429cb0b6c29128aec1919df73d18146c

  • SHA256

    2bbc63f4cebba314039bada0257840c6e37d56bc1d9da2e5fdc347c69fb68dcd

  • SHA512

    fbecc3f70c3425462e145597f9f8d6fe2096be0a06b27889c6229cb37210cf793661de65b50eb356af1058bd98e54fe87bbc300afa18c9c8fee01ae84175ac18

  • SSDEEP

    24576:L2X0fs1PmnLFEvJ6mLQlghgRIRrv6AJMFA2hRzF1lxUq0cxkYb8uTB1GPtiFOiMT:K6EvR4ghiWKYDYAuTBucFtw05gOu

Score
10/10
healerdefense_evasiondiscoverydropperevasiontrojan

Malware Config

Targets

    • Target

      2bbc63f4cebba314039bada0257840c6e37d56bc1d9da2e5fdc347c69fb68dcd

    • Size

      2.6MB

    • MD5

      8d305968f84066b22797cd223f0ea043

    • SHA1

      379225ae429cb0b6c29128aec1919df73d18146c

    • SHA256

      2bbc63f4cebba314039bada0257840c6e37d56bc1d9da2e5fdc347c69fb68dcd

    • SHA512

      fbecc3f70c3425462e145597f9f8d6fe2096be0a06b27889c6229cb37210cf793661de65b50eb356af1058bd98e54fe87bbc300afa18c9c8fee01ae84175ac18

    • SSDEEP

      24576:L2X0fs1PmnLFEvJ6mLQlghgRIRrv6AJMFA2hRzF1lxUq0cxkYb8uTB1GPtiFOiMT:K6EvR4ghiWKYDYAuTBucFtw05gOu

    Score
    10/10
    healerdefense_evasiondiscoverydropperevasiontrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Modifies Windows Defender notification settings

      defense_evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Windows security modification

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks