Overview

overview

8

Static

static

8

eb9cc0a2bb...26.exe

windows7-x64

8

eb9cc0a2bb...26.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eb9cc0a2bb8e06702b8337cbab13d9b62f7951c59d05201e4122f96414824e26

  • Size

    2.0MB

  • Sample

    221125-pe2yesfh26

  • MD5

    cd30f8ff3a00656de5a27543aa485c1d

  • SHA1

    382c95170e86a0cf6160ab791264d5d5e48cb74c

  • SHA256

    eb9cc0a2bb8e06702b8337cbab13d9b62f7951c59d05201e4122f96414824e26

  • SHA512

    32874b8aa1f85cb3c12355d123913e4e0d0a5945fea3d91a579bad6a4f34a5adc7abd6825eb965271101e310e5a852ba496abab304ef20695f2acbca2f543a13

  • SSDEEP

    24576:TTrujPw5FzEOUHK6PHyrZhpoIFdE7OkqyPPQ8v6Dc4JgWrht8UbHv7MeeaqrRbGQ:fru2oNP6ZAh7s5JgqhtDjv7MVaqrRb

Score
8/10
bootkitpersistenceupxvmprotect

Malware Config

Targets

    • Target

      eb9cc0a2bb8e06702b8337cbab13d9b62f7951c59d05201e4122f96414824e26

    • Size

      2.0MB

    • MD5

      cd30f8ff3a00656de5a27543aa485c1d

    • SHA1

      382c95170e86a0cf6160ab791264d5d5e48cb74c

    • SHA256

      eb9cc0a2bb8e06702b8337cbab13d9b62f7951c59d05201e4122f96414824e26

    • SHA512

      32874b8aa1f85cb3c12355d123913e4e0d0a5945fea3d91a579bad6a4f34a5adc7abd6825eb965271101e310e5a852ba496abab304ef20695f2acbca2f543a13

    • SSDEEP

      24576:TTrujPw5FzEOUHK6PHyrZhpoIFdE7OkqyPPQ8v6Dc4JgWrht8UbHv7MeeaqrRbGQ:fru2oNP6ZAh7s5JgqhtDjv7MVaqrRb

    Score
    8/10
    bootkitpersistenceupxvmprotect

    • Drops file in Drivers directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks