Overview

overview

8

Static

static

8

e7275ce521...c1.dll

windows7-x64

8

e7275ce521...c1.dll

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    e7275ce521f0376694c3178442e555cb55614c5a6deedd9f4658d7fde887a7c1

  • Size

    1.4MB

  • Sample

    221203-cmhtashh81

  • MD5

    d2380f47648da28acb358f0954023f64

  • SHA1

    ed0874517b958a08127db05744c192a0d48a247f

  • SHA256

    e7275ce521f0376694c3178442e555cb55614c5a6deedd9f4658d7fde887a7c1

  • SHA512

    1226e4782dcfe24028c0872b2e1a1b7018ae74bd95a2c82891c22112b6ba141e7d877857ab6f7a34a154def57b6a4409035aa714be5f6f075f08264165161e5e

  • SSDEEP

    24576:MxqUxAk+ZgDjcfju2+62uGo4LEfs+rO/SJ9sHGBEoi4P3:M/qNs+j+LH2Eo1P3

Score
8/10
bootkitpersistenceupxvmprotect

Malware Config

Targets

    • Target

      e7275ce521f0376694c3178442e555cb55614c5a6deedd9f4658d7fde887a7c1

    • Size

      1.4MB

    • MD5

      d2380f47648da28acb358f0954023f64

    • SHA1

      ed0874517b958a08127db05744c192a0d48a247f

    • SHA256

      e7275ce521f0376694c3178442e555cb55614c5a6deedd9f4658d7fde887a7c1

    • SHA512

      1226e4782dcfe24028c0872b2e1a1b7018ae74bd95a2c82891c22112b6ba141e7d877857ab6f7a34a154def57b6a4409035aa714be5f6f075f08264165161e5e

    • SSDEEP

      24576:MxqUxAk+ZgDjcfju2+62uGo4LEfs+rO/SJ9sHGBEoi4P3:M/qNs+j+LH2Eo1P3

    Score
    8/10
    bootkitpersistenceupxvmprotect

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks