Overview

overview

9

Static

static

Dubi助手...�].exe

windows7_x64

Dubi助手...�].exe

windows10_x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    Dubi助手[已更新].exe
  • Size 5.5MB
  • Sample201003-t28dwtaawa
  • SHA256 5eb285443b7b9ab49c8b73112f66813eacc811d752e294fd2ca8db89da49589d
  • MD5 SHA1 SHA512
Score
9/10
bootkitpersistenceransomware

Malware Config

Targets

    • Target
      Dubi助手[已更新].exe
    • Size 5.5MB
    • SHA256 5eb285443b7b9ab49c8b73112f66813eacc811d752e294fd2ca8db89da49589d
    • MD5 SHA1 SHA512
    Score
    9/10
    bootkitpersistenceransomware

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies WinLogon to allow AutoLogon

      Enables rebooting of the machine without requiring login credentials.

      ransomwarebootkit

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks