a7c6756bbd00682bb49e3a9a79cc1ca8830d391bef3e809c5310f076d8ee45fe | Triage

Sharing

General

Target

a7c6756bbd00682bb49e3a9a79cc1ca8830d391bef3e809c5310f076d8ee45fe
Size

1.2MB
Sample

221003-gjsljsbgbk
MD5

5b1cf39eb89447f636a223e2d76ff2f0
SHA1

640a37f711b2d66588119b249c1657c4db7d26e7
SHA256

a7c6756bbd00682bb49e3a9a79cc1ca8830d391bef3e809c5310f076d8ee45fe
SHA512

d85484f93406b638b107a5a4e5468b5e915e795eac343f4c99772cd7b9d77a4f3d060adee6f9a822ca73db54568782d001e2fe6e079ed8ec0e16656997c338ca
SSDEEP

24576:xNo9ZIPWpawwmT5ER4omoJaREUgPW7yvF4G/8l+7/g9A:xNLP8TiqAW7q4m8U/6A

Score

7^/10

bootkit evasion persistence trojan

Malware Config

Targets

- Target
  
  a7c6756bbd00682bb49e3a9a79cc1ca8830d391bef3e809c5310f076d8ee45fe
- Size
  
  1.2MB
- MD5
  
  5b1cf39eb89447f636a223e2d76ff2f0
- SHA1
  
  640a37f711b2d66588119b249c1657c4db7d26e7
- SHA256
  
  a7c6756bbd00682bb49e3a9a79cc1ca8830d391bef3e809c5310f076d8ee45fe
- SHA512
  
  d85484f93406b638b107a5a4e5468b5e915e795eac343f4c99772cd7b9d77a4f3d060adee6f9a822ca73db54568782d001e2fe6e079ed8ec0e16656997c338ca
- SSDEEP
  
  24576:xNo9ZIPWpawwmT5ER4omoJaREUgPW7yvF4G/8l+7/g9A:xNLP8TiqAW7q4m8U/6A
Score

7^/10

bootkit evasion persistence trojan
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistencetrojan

behavioral2