7ed08fdd2537e00f16da01dff389af98d6789bc0c549bd9cb7ca59ccad645f38 | Triage

Submit
Reports

Overview

overview

8

Static

static

1

7ed08fdd25...38.exe

windows7-x64

8

7ed08fdd25...38.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

Target

7ed08fdd2537e00f16da01dff389af98d6789bc0c549bd9cb7ca59ccad645f38
Size

411KB
Sample

221012-wklxqaeddk
MD5

6940fc6671afa0e5be7dc6eafcd8e3b7
SHA1

99b58114541480e7f447cf8d9ddf5a1da5bd6e04
SHA256

7ed08fdd2537e00f16da01dff389af98d6789bc0c549bd9cb7ca59ccad645f38
SHA512

7582339c7abcd4d938904b925a4b2862fe69e2c0c04749d070cd7f460087a802a8d2ea5e117cdb3e7ea48f1e7accfbe98b3a940df9e4dadd3ba64becfafc0ef4
SSDEEP

6144:2bN4zwbUXzKJvdTTKgGPsX4b05AT6ntmrhUO65O2q6J/DG/SGkKLmxYIOnV8w:hkUKVdnZ2sXGsjntwirpbtxS

Score

8^/10

bootkit evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

7ed08fdd2537e00f16da01dff389af98d6789bc0c549bd9cb7ca59ccad645f38.exe

Resource

win7-20220812-en

bootkit evasion persistence trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

7ed08fdd2537e00f16da01dff389af98d6789bc0c549bd9cb7ca59ccad645f38.exe

Resource

win10v2004-20220812-en

bootkit persistence upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  7ed08fdd2537e00f16da01dff389af98d6789bc0c549bd9cb7ca59ccad645f38
- Size
  
  411KB
- MD5
  
  6940fc6671afa0e5be7dc6eafcd8e3b7
- SHA1
  
  99b58114541480e7f447cf8d9ddf5a1da5bd6e04
- SHA256
  
  7ed08fdd2537e00f16da01dff389af98d6789bc0c549bd9cb7ca59ccad645f38
- SHA512
  
  7582339c7abcd4d938904b925a4b2862fe69e2c0c04749d070cd7f460087a802a8d2ea5e117cdb3e7ea48f1e7accfbe98b3a940df9e4dadd3ba64becfafc0ef4
- SSDEEP
  
  6144:2bN4zwbUXzKJvdTTKgGPsX4b05AT6ntmrhUO65O2q6J/DG/SGkKLmxYIOnV8w:hkUKVdnZ2sXGsjntwirpbtxS
Score

8^/10

bootkit evasion persistence trojan upx
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistencetrojanupx

behavioral2

bootkitpersistenceupx

© 2018-2025

Terms | Privacy