Overview

overview

8

Static

static

8897dadd9e...b2.exe

windows7-x64

8

8897dadd9e...b2.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    8897dadd9efd5afd19b536c659d14c84017649a5bbaaa210bde105c095139db2

  • Size

    1.1MB

  • Sample

    221129-gvtmzsfe7x

  • MD5

    911fa98a81c5493019750ade6088e516

  • SHA1

    cc33e4adc40be504b0b0304c9be0b8a7654bd7c1

  • SHA256

    8897dadd9efd5afd19b536c659d14c84017649a5bbaaa210bde105c095139db2

  • SHA512

    d9ad3b1ae881e1b8eeb635dac7756ac31e50181d4923b7a8dbef2d3c69513231094ba13cd1310c0a35f57c38fe4fcf6e4734f3d1d96ca6602841b80d87dcc197

  • SSDEEP

    24576:iIot5q/kwVCMozowl4as1wbcip02riCYBPjol2g77kbuHEd:iIoTq/kKC1TUw7r0Be2m7kbuU

Score
8/10
bootkitevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      8897dadd9efd5afd19b536c659d14c84017649a5bbaaa210bde105c095139db2

    • Size

      1.1MB

    • MD5

      911fa98a81c5493019750ade6088e516

    • SHA1

      cc33e4adc40be504b0b0304c9be0b8a7654bd7c1

    • SHA256

      8897dadd9efd5afd19b536c659d14c84017649a5bbaaa210bde105c095139db2

    • SHA512

      d9ad3b1ae881e1b8eeb635dac7756ac31e50181d4923b7a8dbef2d3c69513231094ba13cd1310c0a35f57c38fe4fcf6e4734f3d1d96ca6602841b80d87dcc197

    • SSDEEP

      24576:iIot5q/kwVCMozowl4as1wbcip02riCYBPjol2g77kbuHEd:iIoTq/kKC1TUw7r0Be2m7kbuU

    Score
    8/10
    bootkitevasionpersistencetrojanupx

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks