Overview

overview

8

Static

static

3

f5031ec6fe...60.dll

windows7-x64

8

f5031ec6fe...60.dll

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    f5031ec6feb7689ffbc165c4286b4860.exe

  • Size

    143KB

  • Sample

    231127-xhftcsbh68

  • MD5

    f5031ec6feb7689ffbc165c4286b4860

  • SHA1

    db0739e3ea46c6af151226a44ed90635ae943d19

  • SHA256

    a6d9cbf1822085f472482f543c9144f70a251ac5053f4c7d0a959adec7fb25f7

  • SHA512

    95f46e9e303a9050067ad0e087023f3310dc01a45e4e6e4762554bb8ff89e728cfcdd1e9cbc2b885f8f20fce6e1a9424e0165827b38e8441763db8e450a4699c

  • SSDEEP

    3072:fuyWfGY25kZOwy/cG+gsuFoCU6JtYXSqEL8K+sP2BuHJTaNlhfVNq:6LxZI/cGJsuFHVnYCN+sP2BuHJON7fVE

Score
8/10
bootkitpersistencespywarestealer

Malware Config

Targets

    • Target

      f5031ec6feb7689ffbc165c4286b4860.exe

    • Size

      143KB

    • MD5

      f5031ec6feb7689ffbc165c4286b4860

    • SHA1

      db0739e3ea46c6af151226a44ed90635ae943d19

    • SHA256

      a6d9cbf1822085f472482f543c9144f70a251ac5053f4c7d0a959adec7fb25f7

    • SHA512

      95f46e9e303a9050067ad0e087023f3310dc01a45e4e6e4762554bb8ff89e728cfcdd1e9cbc2b885f8f20fce6e1a9424e0165827b38e8441763db8e450a4699c

    • SSDEEP

      3072:fuyWfGY25kZOwy/cG+gsuFoCU6JtYXSqEL8K+sP2BuHJTaNlhfVNq:6LxZI/cGJsuFHVnYCN+sP2BuHJON7fVE

    Score
    8/10
    bootkitpersistencespywarestealer

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks