General

  • Target

    908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e

  • Size

    1.7MB

  • Sample

    221203-wzsc2sdg22

  • MD5

    25a597ee4c316f9db24e759d7a2b71e0

  • SHA1

    ada3372b3f2b58472ba02410de35d9782679d4f0

  • SHA256

    908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e

  • SHA512

    bd0991ed891174194c2f5d4b6eaa0473ed59325def4c0e2a05b86f3cd8f48357bce27b67089c5bb5cda31d6fab8072bb55b329e3a10a81ab16045087bc162cee

  • SSDEEP

    49152:DUUXu+FQWdQE5/qv9w3imteyIIyDtstDuCOux:DUeu+KW20/qv2ymYDIZp

Malware Config

Targets

    • Target

      908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e

    • Size

      1.7MB

    • MD5

      25a597ee4c316f9db24e759d7a2b71e0

    • SHA1

      ada3372b3f2b58472ba02410de35d9782679d4f0

    • SHA256

      908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e

    • SHA512

      bd0991ed891174194c2f5d4b6eaa0473ed59325def4c0e2a05b86f3cd8f48357bce27b67089c5bb5cda31d6fab8072bb55b329e3a10a81ab16045087bc162cee

    • SSDEEP

      49152:DUUXu+FQWdQE5/qv9w3imteyIIyDtstDuCOux:DUeu+KW20/qv2ymYDIZp

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v6

Tasks