Overview

overview

10

Static

static

3

70965e77d0...23.exe

windows7-x64

10

70965e77d0...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70965e77d05220dc859f81dda4ab259c9c2269b904dec9102e159a9ae0bb7a23.exe

  • Size

    2.7MB

  • Sample

    250201-vc3ptstjgn

  • MD5

    046f3edfde85f46f99149e5017073314

  • SHA1

    6f5df352eb88f039a0b7650283fe36d61b0ce5e0

  • SHA256

    70965e77d05220dc859f81dda4ab259c9c2269b904dec9102e159a9ae0bb7a23

  • SHA512

    ddfb8834ac03ddccd3360bdebe2801dffb7af617cd7e4ceda9b300c5314f06470db7d622e2780d542cbe1f48404e97bb2ce8a6a0773ead1793f73a365a7ca995

  • SSDEEP

    49152:6n/Gh87+Lz9wXxsTXJgU3txAU5ll4Dwrfvd43w9aw7/SvTTWi:c17+Lz9wBsTX/mUd4DwrXC38aw7GvL

Score
10/10
healerdefense_evasiondiscoverydropperevasiontrojan

Malware Config

Targets

    • Target

      70965e77d05220dc859f81dda4ab259c9c2269b904dec9102e159a9ae0bb7a23.exe

    • Size

      2.7MB

    • MD5

      046f3edfde85f46f99149e5017073314

    • SHA1

      6f5df352eb88f039a0b7650283fe36d61b0ce5e0

    • SHA256

      70965e77d05220dc859f81dda4ab259c9c2269b904dec9102e159a9ae0bb7a23

    • SHA512

      ddfb8834ac03ddccd3360bdebe2801dffb7af617cd7e4ceda9b300c5314f06470db7d622e2780d542cbe1f48404e97bb2ce8a6a0773ead1793f73a365a7ca995

    • SSDEEP

      49152:6n/Gh87+Lz9wXxsTXJgU3txAU5ll4Dwrfvd43w9aw7/SvTTWi:c17+Lz9wBsTX/mUd4DwrXC38aw7GvL

    Score
    10/10
    healerdefense_evasiondiscoverydropperevasiontrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Modifies Windows Defender notification settings

      defense_evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Windows security modification

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks