General

  • Target

    fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b

  • Size

    167KB

  • Sample

    221127-qv95eafa61

  • MD5

    35b44cd41c7343d92cf067074b7378be

  • SHA1

    29d5725e83fdd03bdce9233b743e3a902c8cab8c

  • SHA256

    fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b

  • SHA512

    444a76e60b53b1e23df65cf71771d7e857027352a29cec5deef316c2373bdb665f3816a0542062e35f245b8164de310045717a18eeba3e4b5a70df9b5d6e94ac

  • SSDEEP

    3072:33c1fP4AJJhsdy957BDj3xQ/dMdAL0mSG9G2TFT04/B6X0D6My:HOPjmda57tjBa1L0odTJh/IEdy

Malware Config

Targets

    • Target

      fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b

    • Size

      167KB

    • MD5

      35b44cd41c7343d92cf067074b7378be

    • SHA1

      29d5725e83fdd03bdce9233b743e3a902c8cab8c

    • SHA256

      fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b

    • SHA512

      444a76e60b53b1e23df65cf71771d7e857027352a29cec5deef316c2373bdb665f3816a0542062e35f245b8164de310045717a18eeba3e4b5a70df9b5d6e94ac

    • SSDEEP

      3072:33c1fP4AJJhsdy957BDj3xQ/dMdAL0mSG9G2TFT04/B6X0D6My:HOPjmda57tjBa1L0odTJh/IEdy

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Registers COM server for autorun

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v6

Tasks