Overview

overview

8

Static

static

8

0e6d0425ac...5f.exe

windows7-x64

8

0e6d0425ac...5f.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    0e6d0425ac67be88ae91720d2bb6206017fbe51011b9fab6b64c540c1cb5ff5f

  • Size

    2.1MB

  • Sample

    221103-y7d7haegc9

  • MD5

    b1d80d1db10eb45b67919bd300afbf18

  • SHA1

    906eb8f858f2a2dc669f8abfc13fe2830bb3871b

  • SHA256

    0e6d0425ac67be88ae91720d2bb6206017fbe51011b9fab6b64c540c1cb5ff5f

  • SHA512

    4743f7bf880cc1cb9c0a868573bdaff3ece31f085f03eb60029395aa8152a6ebea6a78e3aa3e5a57b25491713a3b11ea4f1133afb554bf6f6781a86d416af27f

  • SSDEEP

    49152:jvwpBtvDgwSJ13avN4TJFTdsHlJ2GTQxtFrWAl/3Dxb0e2zgpoh:0pBt7dSJ1K1NL3Qxt1WAl/3tb/po

Score
8/10
bootkitpersistencevmprotect

Malware Config

Targets

    • Target

      0e6d0425ac67be88ae91720d2bb6206017fbe51011b9fab6b64c540c1cb5ff5f

    • Size

      2.1MB

    • MD5

      b1d80d1db10eb45b67919bd300afbf18

    • SHA1

      906eb8f858f2a2dc669f8abfc13fe2830bb3871b

    • SHA256

      0e6d0425ac67be88ae91720d2bb6206017fbe51011b9fab6b64c540c1cb5ff5f

    • SHA512

      4743f7bf880cc1cb9c0a868573bdaff3ece31f085f03eb60029395aa8152a6ebea6a78e3aa3e5a57b25491713a3b11ea4f1133afb554bf6f6781a86d416af27f

    • SSDEEP

      49152:jvwpBtvDgwSJ13avN4TJFTdsHlJ2GTQxtFrWAl/3Dxb0e2zgpoh:0pBt7dSJ1K1NL3Qxt1WAl/3tb/po

    Score
    8/10
    bootkitpersistencevmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks