Overview

overview

8

Static

static

1

2058ba3787...89.exe

windows7-x64

8

2058ba3787...89.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2058ba3787ac2a09dc2c680f216a4cc3ab0c1079c0d71240c5b5138385e70089

  • Size

    162KB

  • Sample

    221128-flr75aga99

  • MD5

    e85fd7acbea1ba3b012c7d088476af84

  • SHA1

    3824f5441381bf879d8ba24a5bf151a0075e1527

  • SHA256

    2058ba3787ac2a09dc2c680f216a4cc3ab0c1079c0d71240c5b5138385e70089

  • SHA512

    ebe525a3992a5b2da9cf62f11ee63bd2bcc8485811ee695638ab4508a745c671932eacbb2df8043723627a596d05b624082d724ca5c7d478ecef9204f8cbe135

  • SSDEEP

    3072:lZMJnTeM4cJJAhccNcpjgILMc4kbWsqfW9X25rplo6sOvuP4hc1HGr+M9477j2Ny:TeTeM/eccNcBgILMc4CdrmlopP4hc1H3

Score
8/10
bootkitdiscoverypersistenceupx

Malware Config

Targets

    • Target

      2058ba3787ac2a09dc2c680f216a4cc3ab0c1079c0d71240c5b5138385e70089

    • Size

      162KB

    • MD5

      e85fd7acbea1ba3b012c7d088476af84

    • SHA1

      3824f5441381bf879d8ba24a5bf151a0075e1527

    • SHA256

      2058ba3787ac2a09dc2c680f216a4cc3ab0c1079c0d71240c5b5138385e70089

    • SHA512

      ebe525a3992a5b2da9cf62f11ee63bd2bcc8485811ee695638ab4508a745c671932eacbb2df8043723627a596d05b624082d724ca5c7d478ecef9204f8cbe135

    • SSDEEP

      3072:lZMJnTeM4cJJAhccNcpjgILMc4kbWsqfW9X25rplo6sOvuP4hc1HGr+M9477j2Ny:TeTeM/eccNcBgILMc4CdrmlopP4hc1H3

    Score
    8/10
    bootkitdiscoverypersistenceupx

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks