General
-
Target
7bdd03378063066b09faaf995de8a0548381afdba5ed742599b7616192c6ca2a
-
Size
4.6MB
-
Sample
221125-lq333sgf93
-
MD5
0323ae23d7c56924912bc262bfac689b
-
SHA1
c58065b4cdf8871c1f59af94e8241af414ea478e
-
SHA256
7bdd03378063066b09faaf995de8a0548381afdba5ed742599b7616192c6ca2a
-
SHA512
5633f4075ca82147c641e1db29835a73f4d0312b07ec69e9f58217c873afc57dae006f3c6b726f768cd45d1b0f4d2ca06384a85bcb4d2026e68b428e4ee072d0
-
SSDEEP
98304:nLtkZmzpySsQdbyuvoBYU8XlpTmCoFyCMPYT+Hrj:nLygVK9ieYrX3mCoFl6Mkj
Static task
static1
Behavioral task
behavioral1
Sample
7bdd03378063066b09faaf995de8a0548381afdba5ed742599b7616192c6ca2a.exe
Resource
win7-20220812-en
Malware Config
Targets
-
-
Target
7bdd03378063066b09faaf995de8a0548381afdba5ed742599b7616192c6ca2a
-
Size
4.6MB
-
MD5
0323ae23d7c56924912bc262bfac689b
-
SHA1
c58065b4cdf8871c1f59af94e8241af414ea478e
-
SHA256
7bdd03378063066b09faaf995de8a0548381afdba5ed742599b7616192c6ca2a
-
SHA512
5633f4075ca82147c641e1db29835a73f4d0312b07ec69e9f58217c873afc57dae006f3c6b726f768cd45d1b0f4d2ca06384a85bcb4d2026e68b428e4ee072d0
-
SSDEEP
98304:nLtkZmzpySsQdbyuvoBYU8XlpTmCoFyCMPYT+Hrj:nLygVK9ieYrX3mCoFl6Mkj
-
Nirsoft
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Drops Chrome extension
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-