Overview

overview

8

Static

static

8

c31103ee65...a6.exe

windows7_x64

8

c31103ee65...a6.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c31103ee658b926ee2feb90cd148f183f2bdfa4b439236c0724abffb4d5fe8a6

  • Size

    4.0MB

  • Sample

    220520-dk2n3ahfgn

  • MD5

    0b0925123ee395a6c62d9b9efb9fc9d6

  • SHA1

    a682b1710b6db2bda445f123d5a0825e50d7361d

  • SHA256

    c31103ee658b926ee2feb90cd148f183f2bdfa4b439236c0724abffb4d5fe8a6

  • SHA512

    6c4221d56de814406d7b4c28d7d2b5314e1155d3fac7b328a6ddbadb1068b23b9fc81370547fa1bc3c172da79817d9c28e6c40967144530916515ade523e973b

Score
8/10
bootkitpersistencevmprotect

Malware Config

Targets

    • Target

      c31103ee658b926ee2feb90cd148f183f2bdfa4b439236c0724abffb4d5fe8a6

    • Size

      4.0MB

    • MD5

      0b0925123ee395a6c62d9b9efb9fc9d6

    • SHA1

      a682b1710b6db2bda445f123d5a0825e50d7361d

    • SHA256

      c31103ee658b926ee2feb90cd148f183f2bdfa4b439236c0724abffb4d5fe8a6

    • SHA512

      6c4221d56de814406d7b4c28d7d2b5314e1155d3fac7b328a6ddbadb1068b23b9fc81370547fa1bc3c172da79817d9c28e6c40967144530916515ade523e973b

    Score
    8/10
    bootkitpersistencevmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks