55b4944fb7655e4dd50f5e493a771e9131c60926c7ea2d43a86687c386f67eb7 | Triage

Sharing

General

Target

55b4944fb7655e4dd50f5e493a771e9131c60926c7ea2d43a86687c386f67eb7
Size

560KB
Sample

221128-clsxwaca7t
MD5

89f41d8459df9b2e3be905bc593abb7f
SHA1

78a750e1764553d8e8a9c02bbf84f2da27834306
SHA256

55b4944fb7655e4dd50f5e493a771e9131c60926c7ea2d43a86687c386f67eb7
SHA512

93309bcc9387d9aedff8e45ce01de49e2cebfda6c135820b24c94d8a78e21e04c3faec112fcd0718694ef8376daf8f0ef3d1a770823dc18bd60a7fcf82279963
SSDEEP

12288:IfLnsL0uBJA5PrbXTyrpFKLcLQ9Xjz7KNBviuMPZd2:IjnsL0uYQF0cLuXj/6vir+

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  55b4944fb7655e4dd50f5e493a771e9131c60926c7ea2d43a86687c386f67eb7
- Size
  
  560KB
- MD5
  
  89f41d8459df9b2e3be905bc593abb7f
- SHA1
  
  78a750e1764553d8e8a9c02bbf84f2da27834306
- SHA256
  
  55b4944fb7655e4dd50f5e493a771e9131c60926c7ea2d43a86687c386f67eb7
- SHA512
  
  93309bcc9387d9aedff8e45ce01de49e2cebfda6c135820b24c94d8a78e21e04c3faec112fcd0718694ef8376daf8f0ef3d1a770823dc18bd60a7fcf82279963
- SSDEEP
  
  12288:IfLnsL0uBJA5PrbXTyrpFKLcLQ9Xjz7KNBviuMPZd2:IjnsL0uYQF0cLuXj/6vir+
Score

6^/10

bootkit persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence