Overview

overview

8

Static

static

7

1001a8c7f3...87.exe

windows7-x64

1001a8c7f3...87.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ransomware.RedBoot.zip

  • Size

    1.2MB

  • Sample

    230406-vxbf3sga61

  • MD5

    51250dabf7df7832640e4a680676cb46

  • SHA1

    74ba41bb17af6e5638171f7a6d9d49e978d8d3b3

  • SHA256

    7fa2bf61405ac573a21334e34bf713dcb5d1fc0c72674e6cebc48d33a4a14d44

  • SHA512

    43f898d7e5752312a79138dcce94c117a20fb6efd9e522fc1ed3cc2d407d13cacf5b6f810c7c1966c4c03217aeb51fce641feb31b26620ff239756132b17f57a

  • SSDEEP

    24576:X55snqlV0L1X93CIhhFrJK/Hw75gIiaC+4llRCIPY7tdyPHno51SCUR:J53lV0LX5hFrswyVFlMEYSnCw

Score
8/10
bootkitpersistenceransomwareupx

Malware Config

Targets

    • Target

      1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887

    • Size

      1.2MB

    • MD5

      e0340f456f76993fc047bc715dfdae6a

    • SHA1

      d47f6f7e553c4bc44a2fe88c2054de901390b2d7

    • SHA256

      1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887

    • SHA512

      cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc

    • SSDEEP

      24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG

    Score
    8/10
    bootkitpersistenceransomwareupx

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks