Overview

overview

9

Static

static

502d32c0df...ef.exe

windows7-x64

9

502d32c0df...ef.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    502d32c0dface9225f71fbe56f6c9c9005dc5a3d1bf8507b5f67d6dd295e57ef

  • Size

    5.3MB

  • Sample

    230111-zvatzsed34

  • MD5

    e0db80a044a1eea1527234a0f7fbbb3f

  • SHA1

    ef8bec8349f73038df2d68e78324fee6662c402e

  • SHA256

    502d32c0dface9225f71fbe56f6c9c9005dc5a3d1bf8507b5f67d6dd295e57ef

  • SHA512

    fd13513e564d93409852728f8147cebfda8b2fbc7a0c4dce902bf8908296cc9dbc752899698bac40e7e3fc2f14bc42c2302713d942be923c34492c358bc2049c

  • SSDEEP

    98304:15kHK8gaUxBYtSR7Xymxp7xM0flTvr+DhsbXMRlcm5sKeXJSFkUvNbHT7ZMkVbf7:PqUnY0gU7xMKb7MeSFkO1McT

Score
9/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      502d32c0dface9225f71fbe56f6c9c9005dc5a3d1bf8507b5f67d6dd295e57ef

    • Size

      5.3MB

    • MD5

      e0db80a044a1eea1527234a0f7fbbb3f

    • SHA1

      ef8bec8349f73038df2d68e78324fee6662c402e

    • SHA256

      502d32c0dface9225f71fbe56f6c9c9005dc5a3d1bf8507b5f67d6dd295e57ef

    • SHA512

      fd13513e564d93409852728f8147cebfda8b2fbc7a0c4dce902bf8908296cc9dbc752899698bac40e7e3fc2f14bc42c2302713d942be923c34492c358bc2049c

    • SSDEEP

      98304:15kHK8gaUxBYtSR7Xymxp7xM0flTvr+DhsbXMRlcm5sKeXJSFkUvNbHT7ZMkVbf7:PqUnY0gU7xMKb7MeSFkO1McT

    Score
    9/10
    bootkitpersistenceupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks