1502fad05a25e6848111b0da85eba077afe5b499a836b94781bed699451d43e3 | Triage

Sharing

General

Target

A9305B7DBB242388551548F3F.exe
Size

4.4MB
Sample

230630-r8582sde69
MD5

a9305b7dbb242388551548f3f4c4d31f
SHA1

f88e8a90b5a56fa85a82347dc6ab76e0993e3261
SHA256

1502fad05a25e6848111b0da85eba077afe5b499a836b94781bed699451d43e3
SHA512

bd8e258495e40e959a31a4b74e0103c32ebfd349746cfd64ac843194cb482706e824eb37f10d0f456512316b89e87d38aee0eccd98d51f7f938c1f47f7143604
SSDEEP

98304:ivH19ZeZ9RnO8ZCDjw7HZxF6DqGDJ+oemYJRcU:ivH1nqFCDkjZx2DJJCrcU

Score

9^/10

bootkit evasion persistence trojan

Malware Config

Targets

- Target
  
  A9305B7DBB242388551548F3F.exe
- Size
  
  4.4MB
- MD5
  
  a9305b7dbb242388551548f3f4c4d31f
- SHA1
  
  f88e8a90b5a56fa85a82347dc6ab76e0993e3261
- SHA256
  
  1502fad05a25e6848111b0da85eba077afe5b499a836b94781bed699451d43e3
- SHA512
  
  bd8e258495e40e959a31a4b74e0103c32ebfd349746cfd64ac843194cb482706e824eb37f10d0f456512316b89e87d38aee0eccd98d51f7f938c1f47f7143604
- SSDEEP
  
  98304:ivH19ZeZ9RnO8ZCDjw7HZxF6DqGDJ+oemYJRcU:ivH1nqFCDkjZx2DJJCrcU
Score

9^/10

bootkit evasion persistence trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistencetrojan

behavioral2

bootkitevasionpersistencetrojan