ce437bc6a6db71aaf4e28da0fb72016f1769b786d2555c5d3696d9daed9a603b | Triage

Sharing

General

Target

ce437bc6a6db71aaf4e28da0fb72016f1769b786d2555c5d3696d9daed9a603b
Size

1.4MB
Sample

221206-h2banaec43
MD5

25f148881e3c67e69f28b1a7a9ef6781
SHA1

6c48909235b0a893e5811901adc73d3bb86076c5
SHA256

ce437bc6a6db71aaf4e28da0fb72016f1769b786d2555c5d3696d9daed9a603b
SHA512

c6570304169a129d7478f309ca50d6d6fe524a04ca364894c14abd2b267b146cfb9ea3f2f484f453a9d772da1c95e00c40155b6d1056fa11534400352becc5ca
SSDEEP

24576:vRTTgQlFEsWq2MiYy8OA1YY1pHVCc5Ymh9X7FSdqV55Lp7rbzQSVrHbCbw4meqVU:1TlEsWnTc31xlnh9XkqpL5PVdvV/dy

Score

7^/10

bootkit evasion persistence trojan

Malware Config

Targets

- Target
  
  ce437bc6a6db71aaf4e28da0fb72016f1769b786d2555c5d3696d9daed9a603b
- Size
  
  1.4MB
- MD5
  
  25f148881e3c67e69f28b1a7a9ef6781
- SHA1
  
  6c48909235b0a893e5811901adc73d3bb86076c5
- SHA256
  
  ce437bc6a6db71aaf4e28da0fb72016f1769b786d2555c5d3696d9daed9a603b
- SHA512
  
  c6570304169a129d7478f309ca50d6d6fe524a04ca364894c14abd2b267b146cfb9ea3f2f484f453a9d772da1c95e00c40155b6d1056fa11534400352becc5ca
- SSDEEP
  
  24576:vRTTgQlFEsWq2MiYy8OA1YY1pHVCc5Ymh9X7FSdqV55Lp7rbzQSVrHbCbw4meqVU:1TlEsWnTc31xlnh9XkqpL5PVdvV/dy
Score

7^/10

bootkit evasion persistence trojan
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistencetrojan

behavioral2