General
-
Target
1580970442738.jpg
-
Size
76KB
-
Sample
230323-kr464age8x
-
MD5
b314d3c6e34780e3326fe5253f4522b2
-
SHA1
dd2bd989d38c135af9afe96d3cd2cac264640b35
-
SHA256
92f2211ef8bebf0b08f243ea6581259318c60964a780b2842233578bf11f1c32
-
SHA512
05398d65533e8421977715c1d33f36d9aee93c85f9268b0e9ebf2e7e1bf516f253065701fcc018937d7ff62a1a02f0f777e3188adc7e24ab54a2cfe97aa002b0
-
SSDEEP
1536:j78swFHi7c7xjQj7jiUbNTR3LSbiM0jr9Ihn77gxYZ9PxyN3kNtobDOZljfT:BoKcOj3kbIxaQWrAUAqjr
Static task
static1
Malware Config
Targets
-
-
Target
1580970442738.jpg
-
Size
76KB
-
MD5
b314d3c6e34780e3326fe5253f4522b2
-
SHA1
dd2bd989d38c135af9afe96d3cd2cac264640b35
-
SHA256
92f2211ef8bebf0b08f243ea6581259318c60964a780b2842233578bf11f1c32
-
SHA512
05398d65533e8421977715c1d33f36d9aee93c85f9268b0e9ebf2e7e1bf516f253065701fcc018937d7ff62a1a02f0f777e3188adc7e24ab54a2cfe97aa002b0
-
SSDEEP
1536:j78swFHi7c7xjQj7jiUbNTR3LSbiM0jr9Ihn77gxYZ9PxyN3kNtobDOZljfT:BoKcOj3kbIxaQWrAUAqjr
-
Adds policy Run key to start application
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Registers COM server for autorun
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-