Overview

overview

10

Static

static

24db21ed78...63.exe

windows7-x64

10

24db21ed78...63.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24db21ed78d4976b9e49973bc40e5d23439d73729e1599e8298353b67aca7d63

  • Size

    633KB

  • Sample

    221123-vlg5gscc4v

  • MD5

    4ab80e5d9eda641d44d3b251cd4a2d01

  • SHA1

    2f390662c8cbd7042b495a7ef8a8bbfcc6c690ac

  • SHA256

    24db21ed78d4976b9e49973bc40e5d23439d73729e1599e8298353b67aca7d63

  • SHA512

    62d928b6e5cae95ed2c255b4e5dcc3bb861d7b9604f62a0e2d19b5c8bed77bea56402e08f1cbe36ff3a3426e509dffa6453846b970910a1c963958fce2400447

  • SSDEEP

    12288:hKr6SBsPOq7WGhQDtGIYA3DugBIWDwLDFRB:IPYP7WGaDtjYkufLDFP

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      24db21ed78d4976b9e49973bc40e5d23439d73729e1599e8298353b67aca7d63

    • Size

      633KB

    • MD5

      4ab80e5d9eda641d44d3b251cd4a2d01

    • SHA1

      2f390662c8cbd7042b495a7ef8a8bbfcc6c690ac

    • SHA256

      24db21ed78d4976b9e49973bc40e5d23439d73729e1599e8298353b67aca7d63

    • SHA512

      62d928b6e5cae95ed2c255b4e5dcc3bb861d7b9604f62a0e2d19b5c8bed77bea56402e08f1cbe36ff3a3426e509dffa6453846b970910a1c963958fce2400447

    • SSDEEP

      12288:hKr6SBsPOq7WGhQDtGIYA3DugBIWDwLDFRB:IPYP7WGaDtjYkufLDFP

    Score
    10/10
    bootkitevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks