25ab732818d406a8c12b5ad990039e725e6c053cbe15d3331031e103ed234772 | Triage

Sharing

General

Target

25ab732818d406a8c12b5ad990039e725e6c053cbe15d3331031e103ed234772
Size

14.2MB
Sample

231009-lr98saca4w
MD5

0c1b39d350ddb487f14f488011af9379
SHA1

2c0f8af657b3b00231ce46125aac6c3b2938f707
SHA256

25ab732818d406a8c12b5ad990039e725e6c053cbe15d3331031e103ed234772
SHA512

dfaf08150f0ad051cc1a666e0cef2a496643d32aba70844de4d989db6a431704f17c87acb0fa3db16180f49458795f0b63bd5cdbc90103bd162f9a5b49de5565
SSDEEP

393216:hT3rKdjE4iQOduA4pJGofpYxf4bWoEmDCIg2/P:hT3eBEl9duAwjWQ7CC

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  25ab732818d406a8c12b5ad990039e725e6c053cbe15d3331031e103ed234772
- Size
  
  14.2MB
- MD5
  
  0c1b39d350ddb487f14f488011af9379
- SHA1
  
  2c0f8af657b3b00231ce46125aac6c3b2938f707
- SHA256
  
  25ab732818d406a8c12b5ad990039e725e6c053cbe15d3331031e103ed234772
- SHA512
  
  dfaf08150f0ad051cc1a666e0cef2a496643d32aba70844de4d989db6a431704f17c87acb0fa3db16180f49458795f0b63bd5cdbc90103bd162f9a5b49de5565
- SSDEEP
  
  393216:hT3rKdjE4iQOduA4pJGofpYxf4bWoEmDCIg2/P:hT3eBEl9duAwjWQ7CC
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence