29d86377ab1b8f4167aa1635fb27aa88144b831de08f7eb0c674c5008d1ebd9d | Triage

Sharing

General

Target

29d86377ab1b8f4167aa1635fb27aa88144b831de08f7eb0c674c5008d1ebd9d
Size

240KB
Sample

231023-v8z9ksbf7s
MD5

7a80cf9a5d63c498231ee4006edfcc72
SHA1

b22ec6e91a8b7f20025073cd4f9922942e371412
SHA256

29d86377ab1b8f4167aa1635fb27aa88144b831de08f7eb0c674c5008d1ebd9d
SHA512

581cb1307c95a679e6246af60cc962467804d19c116e9f7e041c2f52a2a9e15bfec378d285449ed847df9d158ccae063a3cf837e33928405cb1474050775aed5
SSDEEP

6144:65r3lV6n42+3WSKhxD8RVo2rcaGKNqAwyotp21:6C+3xWDY9IpKNTwyom

Score

8^/10

bootkit persistence spyware stealer

Malware Config

Targets

- Target
  
  29d86377ab1b8f4167aa1635fb27aa88144b831de08f7eb0c674c5008d1ebd9d
- Size
  
  240KB
- MD5
  
  7a80cf9a5d63c498231ee4006edfcc72
- SHA1
  
  b22ec6e91a8b7f20025073cd4f9922942e371412
- SHA256
  
  29d86377ab1b8f4167aa1635fb27aa88144b831de08f7eb0c674c5008d1ebd9d
- SHA512
  
  581cb1307c95a679e6246af60cc962467804d19c116e9f7e041c2f52a2a9e15bfec378d285449ed847df9d158ccae063a3cf837e33928405cb1474050775aed5
- SSDEEP
  
  6144:65r3lV6n42+3WSKhxD8RVo2rcaGKNqAwyotp21:6C+3xWDY9IpKNTwyom
Score

8^/10

bootkit persistence spyware stealer
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistencespywarestealer

behavioral2

bootkitpersistencespywarestealer