Overview

overview

8

Static

static

_J812.exe

windows7_x64

8

_J812.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    _J812

  • Size

    900KB

  • Sample

    210218-2xhrezzce2

  • MD5

    1474bd3eda2e087560754241a0b92991

  • SHA1

    e1e66d856800dbb5ef5bf9c8e937b6514b9f02d7

  • SHA256

    c83e6b96ee3aa1a580157547eae88d112d2202d710218f2ed496f7fe3d861abc

  • SHA512

    ca2cbc155cef666c46e6e4c07cc2e9a61bd15cef8f8f1902d06c6178a1968487fc2ad78e018621a09836755c524215aa9fcb6e62d52b210deec10162edcc9b7f

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      _J812

    • Size

      900KB

    • MD5

      1474bd3eda2e087560754241a0b92991

    • SHA1

      e1e66d856800dbb5ef5bf9c8e937b6514b9f02d7

    • SHA256

      c83e6b96ee3aa1a580157547eae88d112d2202d710218f2ed496f7fe3d861abc

    • SHA512

      ca2cbc155cef666c46e6e4c07cc2e9a61bd15cef8f8f1902d06c6178a1968487fc2ad78e018621a09836755c524215aa9fcb6e62d52b210deec10162edcc9b7f

    Score
    8/10
    bootkitpersistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks