Overview

overview

8

Static

static

5c61d4279a...65.exe

windows7_x64

8

5c61d4279a...65.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c61d4279a66920cdbb4aea1b9bc84f34f563eb63de7ce57296784e4304a7e65

  • Size

    642KB

  • Sample

    220520-e46msscgfq

  • MD5

    3ba57c30e9d76e7a0e16343d6ca9e4d1

  • SHA1

    97fe51a2fd27183b20dfaeba8db5f2738a1eda27

  • SHA256

    5c61d4279a66920cdbb4aea1b9bc84f34f563eb63de7ce57296784e4304a7e65

  • SHA512

    5d356c8399364604c71d6f7b49f34af35bec09802a4f10953ffaaa32db85dd4f0caaed5c96418dc1fec9d4dfc45f96fbec327e22b9e77c4b2d287cc4e5922508

Score
8/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      5c61d4279a66920cdbb4aea1b9bc84f34f563eb63de7ce57296784e4304a7e65

    • Size

      642KB

    • MD5

      3ba57c30e9d76e7a0e16343d6ca9e4d1

    • SHA1

      97fe51a2fd27183b20dfaeba8db5f2738a1eda27

    • SHA256

      5c61d4279a66920cdbb4aea1b9bc84f34f563eb63de7ce57296784e4304a7e65

    • SHA512

      5d356c8399364604c71d6f7b49f34af35bec09802a4f10953ffaaa32db85dd4f0caaed5c96418dc1fec9d4dfc45f96fbec327e22b9e77c4b2d287cc4e5922508

    Score
    8/10
    bootkitevasionpersistence

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks