cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc | Triage

Sharing

General

Target

cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc
Size

329KB
Sample

221203-e3v5nsea96
MD5

34f8df93f01d64536e8dc0f417c8d475
SHA1

16e83c0e54980a4668ee76daffe24fa44d97b6a5
SHA256

cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc
SHA512

7ed3bdf7a3b45cd17d024c50c1d2043199a9a0515eafa424346136826a3f3f18b4cab37b8097601401f50a9238aa938bedb0a7d9642447a7ace37e6387ce5ec8
SSDEEP

6144:XZY/eK/Dr1FFr6I1+a0KgiTo/jcPkce5ln98gWNlPTGQQm6agrdr8:JY/VbFrB1nJgiTwjcPHyGNtTirdr8

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc
- Size
  
  329KB
- MD5
  
  34f8df93f01d64536e8dc0f417c8d475
- SHA1
  
  16e83c0e54980a4668ee76daffe24fa44d97b6a5
- SHA256
  
  cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc
- SHA512
  
  7ed3bdf7a3b45cd17d024c50c1d2043199a9a0515eafa424346136826a3f3f18b4cab37b8097601401f50a9238aa938bedb0a7d9642447a7ace37e6387ce5ec8
- SSDEEP
  
  6144:XZY/eK/Dr1FFr6I1+a0KgiTo/jcPkce5ln98gWNlPTGQQm6agrdr8:JY/VbFrB1nJgiTwjcPHyGNtTirdr8
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2