Overview

overview

8

Static

static

349a52b2d0...ac.exe

windows7_x64

8

349a52b2d0...ac.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    349a52b2d011c6f570d87ca4706a644c0f4ab8a6b96decd522c2fd789ecf50ac.zip

  • Size

    3.2MB

  • Sample

    201105-jt2365qrta

  • MD5

    04123e749bd83f4ec0f0dd6ac5e84e66

  • SHA1

    ba4bf8af037b11833e71e14b484b5895cd8c6dfb

  • SHA256

    21745fbeba10fd788597919ca9f05e06fd86cf09b4b8351af41be5999cc27c1c

  • SHA512

    7900a2efc5c990e1f041bf747590886f1ad50807860bc636b3c69e915627cc247577f5f74be237be3d5cb6068937a884e77bc2c0f81d02d25a1943eb58c88144

Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      349a52b2d011c6f570d87ca4706a644c0f4ab8a6b96decd522c2fd789ecf50ac

    • Size

      3.2MB

    • MD5

      b2a187d0d7a8209e304854e8bd9006db

    • SHA1

      6e8f07f4aa9e26756dccb95f7a9f02f35b7eecda

    • SHA256

      349a52b2d011c6f570d87ca4706a644c0f4ab8a6b96decd522c2fd789ecf50ac

    • SHA512

      016e61ecea8d5a572436b86a45e8a40ded86eccdfe84842857dea3131c74fed5ecb85bc76ae1a782e1083d74855fe0de4680db22f82e458268e19a12daefc502

    Score
    8/10
    bootkitdiscoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • JavaScript code in executable

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks