Overview

overview

7

Static

static

3

8afc905c26...44.exe

windows7-x64

7

8afc905c26...44.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8afc905c264a7e00b89e1f29d2e30d44.bin

  • Size

    17.1MB

  • Sample

    230820-b8rsnada66

  • MD5

    8afc905c264a7e00b89e1f29d2e30d44

  • SHA1

    70b57a174fd6210c3a5241f20af43cf079e2e245

  • SHA256

    ea087c479b0f47c8ec7026eb3ff2b6d1cf939f63715b3a7519ddc403bf6b513b

  • SHA512

    279b399fa98691f560621abf975d8846e948fd780ea5e1ac53bc5e5faa13b193d24f0ed08775c5c58ea89a8c0ddb4658b768e9921ce96269b4ba893c696075a1

  • SSDEEP

    393216:0V0Q4oIqRsl/c38/EV7w7GQTExdsjbqfnkgzObnzRb6:QSEq/q8cGK6EPNnlzOb0

Score
7/10
bootkitpersistencevmprotect

Malware Config

Targets

    • Target

      8afc905c264a7e00b89e1f29d2e30d44.bin

    • Size

      17.1MB

    • MD5

      8afc905c264a7e00b89e1f29d2e30d44

    • SHA1

      70b57a174fd6210c3a5241f20af43cf079e2e245

    • SHA256

      ea087c479b0f47c8ec7026eb3ff2b6d1cf939f63715b3a7519ddc403bf6b513b

    • SHA512

      279b399fa98691f560621abf975d8846e948fd780ea5e1ac53bc5e5faa13b193d24f0ed08775c5c58ea89a8c0ddb4658b768e9921ce96269b4ba893c696075a1

    • SSDEEP

      393216:0V0Q4oIqRsl/c38/EV7w7GQTExdsjbqfnkgzObnzRb6:QSEq/q8cGK6EPNnlzOb0

    Score
    7/10
    bootkitpersistencevmprotect

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks