Overview

overview

7

Static

static

7

d88140642f...62.exe

windows7-x64

7

d88140642f...62.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d88140642f0e018b0f6654c69996a338a2781997d390400eb1878b78fa2d6d62

  • Size

    3.8MB

  • Sample

    231013-qj9z9sbh95

  • MD5

    c65b563968b5ba641076ca1d26ec077f

  • SHA1

    ff7194fc090b11c535e3961e7c3a680c9e8e5b9e

  • SHA256

    d88140642f0e018b0f6654c69996a338a2781997d390400eb1878b78fa2d6d62

  • SHA512

    fa60f8c79ddf16189be5bc68c6838bf67a7e56c29567803dfa0aa4298edf07fa10bb8dda574344e99fff5f5e8bcf068cda28eedecac256e4df19019d24db6b6e

  • SSDEEP

    98304:A9stARKqSW0N2JjG1TFcu9itvddGi/JloKJYBx22aEQVM:yKqNwn1TuuKGi/zJyAzo

Score
7/10
bootkitpersistencevmprotect

Malware Config

Targets

    • Target

      d88140642f0e018b0f6654c69996a338a2781997d390400eb1878b78fa2d6d62

    • Size

      3.8MB

    • MD5

      c65b563968b5ba641076ca1d26ec077f

    • SHA1

      ff7194fc090b11c535e3961e7c3a680c9e8e5b9e

    • SHA256

      d88140642f0e018b0f6654c69996a338a2781997d390400eb1878b78fa2d6d62

    • SHA512

      fa60f8c79ddf16189be5bc68c6838bf67a7e56c29567803dfa0aa4298edf07fa10bb8dda574344e99fff5f5e8bcf068cda28eedecac256e4df19019d24db6b6e

    • SSDEEP

      98304:A9stARKqSW0N2JjG1TFcu9itvddGi/JloKJYBx22aEQVM:yKqNwn1TuuKGi/zJyAzo

    Score
    7/10
    bootkitpersistencevmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks