Overview

overview

10

Static

static

fd1bbc33b4...ad.exe

windows7-x64

10

fd1bbc33b4...ad.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    fd1bbc33b4161303c72b30c2ea2728437fb23dadf584d134ada046d35c53f1ad

  • Size

    593KB

  • Sample

    221020-jlmt7acacp

  • MD5

    7a425f65756af4134a4dc89264613e2f

  • SHA1

    af51657c3375a8d6c4a5d027ea7b0d00f36b8a9e

  • SHA256

    fd1bbc33b4161303c72b30c2ea2728437fb23dadf584d134ada046d35c53f1ad

  • SHA512

    efd5aaa9f2d57263df3917f94992845568fd3e7c1f1a4cd9c436a572b62d995f970fe9c566ee96097057c7b363823eb8cbaad89a18ad0f81b09dcda0d44fba03

  • SSDEEP

    12288:VuBSP/amCoBJSpc/aaT9/gur79Yq63kfydqAKTE1qH:sA6oBwy/aI/gK79YH0FAgxH

Score
10/10
bootkitevasionpersistenceupx

Malware Config

Targets

    • Target

      fd1bbc33b4161303c72b30c2ea2728437fb23dadf584d134ada046d35c53f1ad

    • Size

      593KB

    • MD5

      7a425f65756af4134a4dc89264613e2f

    • SHA1

      af51657c3375a8d6c4a5d027ea7b0d00f36b8a9e

    • SHA256

      fd1bbc33b4161303c72b30c2ea2728437fb23dadf584d134ada046d35c53f1ad

    • SHA512

      efd5aaa9f2d57263df3917f94992845568fd3e7c1f1a4cd9c436a572b62d995f970fe9c566ee96097057c7b363823eb8cbaad89a18ad0f81b09dcda0d44fba03

    • SSDEEP

      12288:VuBSP/amCoBJSpc/aaT9/gur79Yq63kfydqAKTE1qH:sA6oBwy/aI/gK79YH0FAgxH

    Score
    10/10
    bootkitevasionpersistenceupx

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks