f5afbd0eb542d325b33a19cbc4f16bd90f1f3bbb6f99e691b08437d643a6cfdc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f5afbd0eb542d325b33a19cbc4f16bd90f1f3bbb6f99e691b08437d643a6cfdc
Size

8.6MB
Sample

221129-h8g2sabg8v
MD5

18d6a5ea44dfde0a7f1b1377a529292a
SHA1

363cf661d8d3ec7ee58949ff932f1e57f35e2942
SHA256

f5afbd0eb542d325b33a19cbc4f16bd90f1f3bbb6f99e691b08437d643a6cfdc
SHA512

5628b90cd2aa2d688689b1a58409e8a16f770440019c2e56b449b5e71e080d934d50a7af17f427f5bba5b21f9fe93dc9008ee1de056c46d8e02c89517d4849b9
SSDEEP

196608:vrg5GjqMEnMgvs/s7veVyGXqRx3y/1MLF4kwhtvMp2YultI+FQim/9Di3PM:s5JMUMgveszeVFaby/1MmkkHYuk+FxmD

Score

9^/10

bootkit persistence

Malware Config

Targets

- Target
  
  f5afbd0eb542d325b33a19cbc4f16bd90f1f3bbb6f99e691b08437d643a6cfdc
- Size
  
  8.6MB
- MD5
  
  18d6a5ea44dfde0a7f1b1377a529292a
- SHA1
  
  363cf661d8d3ec7ee58949ff932f1e57f35e2942
- SHA256
  
  f5afbd0eb542d325b33a19cbc4f16bd90f1f3bbb6f99e691b08437d643a6cfdc
- SHA512
  
  5628b90cd2aa2d688689b1a58409e8a16f770440019c2e56b449b5e71e080d934d50a7af17f427f5bba5b21f9fe93dc9008ee1de056c46d8e02c89517d4849b9
- SSDEEP
  
  196608:vrg5GjqMEnMgvs/s7veVyGXqRx3y/1MLF4kwhtvMp2YultI+FQim/9Di3PM:s5JMUMgveszeVFaby/1MmkkHYuk+FxmD
Score

9^/10

bootkit persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence