588e535f6d016f193e3168207c2e81dcb803f2d1594e1888f3c7d9a14488eb40

General

Target

import os.txt
Size

1KB
Sample

230405-bq1b3sda4x
MD5

e1ee6fe9e086a9618d617b7ec418ec6a
SHA1

7ae9e9ca2a82f45b9427afb6b1390c0c2a61ad49
SHA256

588e535f6d016f193e3168207c2e81dcb803f2d1594e1888f3c7d9a14488eb40
SHA512

ad2b3e351aeb3b7b62d6f5424e23cf4a3634751b5c0200b111153cd067a0de0f529517e3cae3197159f25771dae2b4cecb273b070f804c7be186f6305b344bc7

Score

9^/10

Malware Config

Targets

- Target
  
  import os.txt
- Size
  
  1KB
- MD5
  
  e1ee6fe9e086a9618d617b7ec418ec6a
- SHA1
  
  7ae9e9ca2a82f45b9427afb6b1390c0c2a61ad49
- SHA256
  
  588e535f6d016f193e3168207c2e81dcb803f2d1594e1888f3c7d9a14488eb40
- SHA512
  
  ad2b3e351aeb3b7b62d6f5424e23cf4a3634751b5c0200b111153cd067a0de0f529517e3cae3197159f25771dae2b4cecb273b070f804c7be186f6305b344bc7
Score

9^/10

bootkit discovery evasion persistence spyware stealer trojan
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1