Overview

overview

7

Static

static

7

7d8ba188ad...69.exe

windows7-x64

7

7d8ba188ad...69.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d8ba188addb8b49dec1bbec330674f20859eecbb362e1e991d77ade8bc60769

  • Size

    11.6MB

  • Sample

    231013-qkln3abh97

  • MD5

    a5f3979f4bf03ed2a9bb0ea298c3c11f

  • SHA1

    dacb68af7bb68f5c16b9810d726a36d752413d26

  • SHA256

    7d8ba188addb8b49dec1bbec330674f20859eecbb362e1e991d77ade8bc60769

  • SHA512

    102a64a3edf1c856184c02f654cf3ce0fa939ed0fa9d1cc1ad535c33ba433cde61419d931971ad6a4289a211d3a02c7298c0831c100cd98f4667c6350f670185

  • SSDEEP

    196608:ltpHEGZla4YxmDuStYKQM4e1upVcZvQfffHQVWXFQ4T3kniKJzV/k6Mp48ehN:lthdsmiKue14VcZvyQVWXFQjniKJzV/p

Score
7/10
bootkitpersistenceupxvmprotect

Malware Config

Targets

    • Target

      7d8ba188addb8b49dec1bbec330674f20859eecbb362e1e991d77ade8bc60769

    • Size

      11.6MB

    • MD5

      a5f3979f4bf03ed2a9bb0ea298c3c11f

    • SHA1

      dacb68af7bb68f5c16b9810d726a36d752413d26

    • SHA256

      7d8ba188addb8b49dec1bbec330674f20859eecbb362e1e991d77ade8bc60769

    • SHA512

      102a64a3edf1c856184c02f654cf3ce0fa939ed0fa9d1cc1ad535c33ba433cde61419d931971ad6a4289a211d3a02c7298c0831c100cd98f4667c6350f670185

    • SSDEEP

      196608:ltpHEGZla4YxmDuStYKQM4e1upVcZvQfffHQVWXFQ4T3kniKJzV/k6Mp48ehN:lthdsmiKue14VcZvyQVWXFQjniKJzV/p

    Score
    7/10
    bootkitpersistenceupxvmprotect

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks