Overview

overview

8

Static

static

1

bcf394a2b8...38.exe

windows7-x64

8

bcf394a2b8...38.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bcf394a2b83ea095f4d0ac0c1f70855006b4c5fc0f1a65c08f96b4baa2143138

  • Size

    596KB

  • Sample

    221204-n4qe9abd2s

  • MD5

    1bc22ed53ff1570764e0509c3244cf5b

  • SHA1

    949b25392679e31413c50c30f8fc79e153d7b7f8

  • SHA256

    bcf394a2b83ea095f4d0ac0c1f70855006b4c5fc0f1a65c08f96b4baa2143138

  • SHA512

    131d9608fdec85c1527a37a471949bd9bdc0779cd878abf8ea4f7656e1cd2d7eb06b89cdfda0cab25c2b55f78e6a68037d98f0aeba0c7715c3e078c32d82673b

  • SSDEEP

    12288:tHTlh92AH0dOKrl7gGEvofiRz9QE+gd1m2UgMFA+l0IPIN:tzlhILcQgtJ/QEVgZ2

Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      bcf394a2b83ea095f4d0ac0c1f70855006b4c5fc0f1a65c08f96b4baa2143138

    • Size

      596KB

    • MD5

      1bc22ed53ff1570764e0509c3244cf5b

    • SHA1

      949b25392679e31413c50c30f8fc79e153d7b7f8

    • SHA256

      bcf394a2b83ea095f4d0ac0c1f70855006b4c5fc0f1a65c08f96b4baa2143138

    • SHA512

      131d9608fdec85c1527a37a471949bd9bdc0779cd878abf8ea4f7656e1cd2d7eb06b89cdfda0cab25c2b55f78e6a68037d98f0aeba0c7715c3e078c32d82673b

    • SSDEEP

      12288:tHTlh92AH0dOKrl7gGEvofiRz9QE+gd1m2UgMFA+l0IPIN:tzlhILcQgtJ/QEVgZ2

    Score
    8/10
    bootkitdiscoverypersistence

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks