Overview

overview

8

Static

static

00ddba492e...55.exe

windows7_x64

8

00ddba492e...55.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00ddba492ec2ac7df8bce0acd0b784a4d1be76bdd3b62aea792b0df95b102855

  • Size

    573KB

  • Sample

    220524-eq3zrafcg7

  • MD5

    156603f5047a0b18d8b8762fb98b16b0

  • SHA1

    5ab23ca80741d0afb620a9947d73f313c9254736

  • SHA256

    00ddba492ec2ac7df8bce0acd0b784a4d1be76bdd3b62aea792b0df95b102855

  • SHA512

    1e4ddeaf82a9ccb6455c5b84fc4b82f67562e5fc7029e40e89ff5ea993b7a03b69492a8be95e4a2c92bde83db931d2bb2af480491a549b4484b387e3444195dd

Score
8/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      00ddba492ec2ac7df8bce0acd0b784a4d1be76bdd3b62aea792b0df95b102855

    • Size

      573KB

    • MD5

      156603f5047a0b18d8b8762fb98b16b0

    • SHA1

      5ab23ca80741d0afb620a9947d73f313c9254736

    • SHA256

      00ddba492ec2ac7df8bce0acd0b784a4d1be76bdd3b62aea792b0df95b102855

    • SHA512

      1e4ddeaf82a9ccb6455c5b84fc4b82f67562e5fc7029e40e89ff5ea993b7a03b69492a8be95e4a2c92bde83db931d2bb2af480491a549b4484b387e3444195dd

    Score
    8/10
    bootkitpersistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks