Overview

overview

9

Static

static

yf133_xqd.exe

windows7-x64

9

yf133_xqd.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    632adedec9c01a934c95f6941110f177d822dbed9e4496eb802af68b00597050

  • Size

    437KB

  • Sample

    221125-1st1hscf2s

  • MD5

    6889e8975f84c61c4e5711563cf7ad2e

  • SHA1

    9dc4c054f82cc85f637def839abd848fd4c8a9db

  • SHA256

    632adedec9c01a934c95f6941110f177d822dbed9e4496eb802af68b00597050

  • SHA512

    9ea12b631cec5a51741094172d2eb0d72cf8a4ec00cc4c6831b66e15b5f27a51d777f941e45846e33cd71f3cba3071c9663af2d4affa08413db843d357d5a832

  • SSDEEP

    12288:FBy7CCte+hMO535KylQTaaXZY6iLp/XcXPju:FByGCc4Mq5eDOH1c/q

Score
9/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      yf133_xqd.exe

    • Size

      1.1MB

    • MD5

      16197ff4dc344c4f453ac2430980e0e3

    • SHA1

      e06699d62594c203323b28c66b563fac18a69256

    • SHA256

      660762a96229ef478fcc798128396472513ab24a29798ebf6522b301b8123f9e

    • SHA512

      c7f285377cb9953ef30910a8f2c658bff770f909a499be8b59f92adfb0fb1f344f5c2d1751058f88ff2da9e4a057728695b1bab48b373861ad0aec401abf40bd

    • SSDEEP

      24576:CkuKcCxfJ+Cop1DJjFOrCr3LQHwra/LvG3y:CkvB+1v7rkQCp

    Score
    9/10
    bootkitpersistenceupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks