Overview

overview

8

Static

static

5bdaab99b9...7d.exe

windows7-x64

8

5bdaab99b9...7d.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d

  • Size

    847KB

  • Sample

    221201-3k79aafe9v

  • MD5

    030a85605dcbad5ab2e76197a51773b0

  • SHA1

    14412b08f4ed847c1c442e682e9990f1e9fa2398

  • SHA256

    5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d

  • SHA512

    55982fb73085432b1712a3fafd9f946b8bfebce23cad8a2745425f00576ae476fff0025a38d682fe9cf3f2ca3f129859717af62c895304e82b7a8694ac1e2f51

  • SSDEEP

    12288:DcCyEQR8/FIZxdV841GoqE6bxl9a/OXvcd7ERtEUqvgdX59RW3lC3TE3NhBClkII:3yX3ZxdV39+oEckdqvcX53WEEX0KII

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d

    • Size

      847KB

    • MD5

      030a85605dcbad5ab2e76197a51773b0

    • SHA1

      14412b08f4ed847c1c442e682e9990f1e9fa2398

    • SHA256

      5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d

    • SHA512

      55982fb73085432b1712a3fafd9f946b8bfebce23cad8a2745425f00576ae476fff0025a38d682fe9cf3f2ca3f129859717af62c895304e82b7a8694ac1e2f51

    • SSDEEP

      12288:DcCyEQR8/FIZxdV841GoqE6bxl9a/OXvcd7ERtEUqvgdX59RW3lC3TE3NhBClkII:3yX3ZxdV39+oEckdqvcX53WEEX0KII

    Score
    8/10
    bootkitpersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks