General

  • Target

    5357fbff137b5ad83b0ae7a2eb9f9762844987d888d29c3afec372568f525fde

  • Size

    2.0MB

  • Sample

    220520-wlqbjabdb5

  • MD5

    c8cba838e87f76326dff14153ffa7070

  • SHA1

    91cd18b7dad6f3e1cbc08fd0c6ac8e552f0b3590

  • SHA256

    5357fbff137b5ad83b0ae7a2eb9f9762844987d888d29c3afec372568f525fde

  • SHA512

    2e83f2f8ed6f4688781f3636b41b95040f414d0dc141e66037b039b6d4895c0a56552ef1ad0503356f533753aef8840b312fe81415128853994c14532d401194

Malware Config

Targets

    • Target

      5357fbff137b5ad83b0ae7a2eb9f9762844987d888d29c3afec372568f525fde

    • Size

      2.0MB

    • MD5

      c8cba838e87f76326dff14153ffa7070

    • SHA1

      91cd18b7dad6f3e1cbc08fd0c6ac8e552f0b3590

    • SHA256

      5357fbff137b5ad83b0ae7a2eb9f9762844987d888d29c3afec372568f525fde

    • SHA512

      2e83f2f8ed6f4688781f3636b41b95040f414d0dc141e66037b039b6d4895c0a56552ef1ad0503356f533753aef8840b312fe81415128853994c14532d401194

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

5
T1082

Tasks