General
-
Target
342b887667d91099f3a2109bb8b2dbb08e4552ea8d6b3aad6dfa57a4eb0e079c
-
Size
4.6MB
-
Sample
221125-lwg3ssce8t
-
MD5
78c279426e28a8188c1fc88d43f74061
-
SHA1
7766849c6497f2d62f69758a2c7ea74c03c46d84
-
SHA256
342b887667d91099f3a2109bb8b2dbb08e4552ea8d6b3aad6dfa57a4eb0e079c
-
SHA512
13ef7318605df54c129a8854113c740f59a9b11d0e6083834b9dc2f1aeace4f6bf21dd5d0561c8c74d7486a124f4a0a091cd557203d5da63a604c7b9e9d3792a
-
SSDEEP
98304:ILtkZmzpySsQdbyuvoBYU8XlpTmCoFyCMPYT+Hrj:ILygVK9ieYrX3mCoFl6Mkj
Static task
static1
Behavioral task
behavioral1
Sample
342b887667d91099f3a2109bb8b2dbb08e4552ea8d6b3aad6dfa57a4eb0e079c.exe
Resource
win7-20221111-en
Malware Config
Targets
-
-
Target
342b887667d91099f3a2109bb8b2dbb08e4552ea8d6b3aad6dfa57a4eb0e079c
-
Size
4.6MB
-
MD5
78c279426e28a8188c1fc88d43f74061
-
SHA1
7766849c6497f2d62f69758a2c7ea74c03c46d84
-
SHA256
342b887667d91099f3a2109bb8b2dbb08e4552ea8d6b3aad6dfa57a4eb0e079c
-
SHA512
13ef7318605df54c129a8854113c740f59a9b11d0e6083834b9dc2f1aeace4f6bf21dd5d0561c8c74d7486a124f4a0a091cd557203d5da63a604c7b9e9d3792a
-
SSDEEP
98304:ILtkZmzpySsQdbyuvoBYU8XlpTmCoFyCMPYT+Hrj:ILygVK9ieYrX3mCoFl6Mkj
-
Nirsoft
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Drops Chrome extension
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-