3e8bd6bff3d8c432a60df1f576b7450bc4cb714d9e4ca7203ebe7a25b4c2ebb9 | Triage

Sharing

General

Target

3e8bd6bff3d8c432a60df1f576b7450bc4cb714d9e4ca7203ebe7a25b4c2ebb9
Size

2.2MB
Sample

221125-xykr9ahc73
MD5

d7081cb82caae9f3c92959c8d306bb3d
SHA1

cfa7970fb1e7b8418874c5ea32eb50add5f7ae76
SHA256

3e8bd6bff3d8c432a60df1f576b7450bc4cb714d9e4ca7203ebe7a25b4c2ebb9
SHA512

dd0f5a19d0e51dc2c4be248b64f0092fdccc3b3ca4af0308d634999842c6112eeb7654ee87e7dce338b04a7596af1e16ce7db37d79a7e05ac8dabd96ab4d18e1
SSDEEP

49152:V8YNkq89Zgn45RSSYecp4glp+fjpR9mGYgci6krCRhaqIvk:V5NkqrMRS1pj+9R9uFkrchaC

Score

9^/10

bootkit evasion persistence trojan

Malware Config

Targets

- Target
  
  3e8bd6bff3d8c432a60df1f576b7450bc4cb714d9e4ca7203ebe7a25b4c2ebb9
- Size
  
  2.2MB
- MD5
  
  d7081cb82caae9f3c92959c8d306bb3d
- SHA1
  
  cfa7970fb1e7b8418874c5ea32eb50add5f7ae76
- SHA256
  
  3e8bd6bff3d8c432a60df1f576b7450bc4cb714d9e4ca7203ebe7a25b4c2ebb9
- SHA512
  
  dd0f5a19d0e51dc2c4be248b64f0092fdccc3b3ca4af0308d634999842c6112eeb7654ee87e7dce338b04a7596af1e16ce7db37d79a7e05ac8dabd96ab4d18e1
- SSDEEP
  
  49152:V8YNkq89Zgn45RSSYecp4glp+fjpR9mGYgci6krCRhaqIvk:V5NkqrMRS1pj+9R9uFkrchaC
Score

9^/10

bootkit evasion persistence trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistencetrojan

behavioral2

bootkitevasionpersistencetrojan