25ff571dee6de94ac44e8b944288e5b2434a3aa2f60245bdfb092ab84536e6ca | Triage

Sharing

General

Target

25ff571dee6de94ac44e8b944288e5b2434a3aa2f60245bdfb092ab84536e6ca
Size

3.4MB
Sample

221230-wvamfabd4y
MD5

7c2f18c381ac16f493451ab9af91e090
SHA1

aa9af6617e53c5f2a5dd1064e957d8d7977edc6f
SHA256

25ff571dee6de94ac44e8b944288e5b2434a3aa2f60245bdfb092ab84536e6ca
SHA512

c1a9bbf1500f8bc49ca3a5081c2792b8e53c0563106d1ecc55cd19c38995a3322157cf848621e1298fea52168ecaf073ff6378e17c37591f7ff4030363fec05a
SSDEEP

98304:f3M+tVrpDfnwMn1scL84djB2o0bZx5264AbsZlO8mZ:kIVB31scY4v2DnHwKZ

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  25ff571dee6de94ac44e8b944288e5b2434a3aa2f60245bdfb092ab84536e6ca
- Size
  
  3.4MB
- MD5
  
  7c2f18c381ac16f493451ab9af91e090
- SHA1
  
  aa9af6617e53c5f2a5dd1064e957d8d7977edc6f
- SHA256
  
  25ff571dee6de94ac44e8b944288e5b2434a3aa2f60245bdfb092ab84536e6ca
- SHA512
  
  c1a9bbf1500f8bc49ca3a5081c2792b8e53c0563106d1ecc55cd19c38995a3322157cf848621e1298fea52168ecaf073ff6378e17c37591f7ff4030363fec05a
- SSDEEP
  
  98304:f3M+tVrpDfnwMn1scL84djB2o0bZx5264AbsZlO8mZ:kIVB31scY4v2DnHwKZ
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence