9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e
Size

747KB
Sample

221106-vrlpvscgf2
MD5

0a761a42df19f37b549f2d66ef97c4d9
SHA1

4d0ab7235271344e2b2508694068c102550b6b11
SHA256

9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e
SHA512

3035209e7c8426d8a85366b55c3a97f1abf8e92a41f13bdd0921720dc22e6d63787dc773690e90801d2a4cc548a5b4674321e8a0d4a15f9bc658b096ae6e62fa
SSDEEP

12288:85g44HH0xRmmIDemFDPuD0HOuxpPGAAoi57J6:85gTHHAgNPuYjuJ6

Score

10^/10

bootkit evasion persistence

Malware Config

Targets

- Target
  
  9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e
- Size
  
  747KB
- MD5
  
  0a761a42df19f37b549f2d66ef97c4d9
- SHA1
  
  4d0ab7235271344e2b2508694068c102550b6b11
- SHA256
  
  9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e
- SHA512
  
  3035209e7c8426d8a85366b55c3a97f1abf8e92a41f13bdd0921720dc22e6d63787dc773690e90801d2a4cc548a5b4674321e8a0d4a15f9bc658b096ae6e62fa
- SSDEEP
  
  12288:85g44HH0xRmmIDemFDPuD0HOuxpPGAAoi57J6:85gTHHAgNPuYjuJ6
Score

10^/10

bootkit persistence evasion
- Modifies firewall policy service
  evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitevasionpersistence