Overview

overview

9

Static

static

3

e9b5131467...39.exe

windows7-x64

9

e9b5131467...39.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e9b513146741397c9731871a5e911239

  • Size

    54KB

  • Sample

    231222-tlyxkagdb4

  • MD5

    e9b513146741397c9731871a5e911239

  • SHA1

    754a8ecace3d3ab6b81c8be7d8d24af31ed91f16

  • SHA256

    99daf146aa2489ced5e8763fa5c5de67019de80369383402bd1e422127960fff

  • SHA512

    cdc70846b5824a6db474786579167d3e23830a2cf38c5725a32bd4d08b53eae222c8f5f15c284c65d922b2ca23aef6d19be4c3085a23a966363f3080c6ec1e55

  • SSDEEP

    1536:IuqXk2fJWIIsrxYvaRvNaKMu+/Jj8DT1iy11WZwoQD:Nek0KiR1uu+/Md1bD

Score
9/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      e9b513146741397c9731871a5e911239

    • Size

      54KB

    • MD5

      e9b513146741397c9731871a5e911239

    • SHA1

      754a8ecace3d3ab6b81c8be7d8d24af31ed91f16

    • SHA256

      99daf146aa2489ced5e8763fa5c5de67019de80369383402bd1e422127960fff

    • SHA512

      cdc70846b5824a6db474786579167d3e23830a2cf38c5725a32bd4d08b53eae222c8f5f15c284c65d922b2ca23aef6d19be4c3085a23a966363f3080c6ec1e55

    • SSDEEP

      1536:IuqXk2fJWIIsrxYvaRvNaKMu+/Jj8DT1iy11WZwoQD:Nek0KiR1uu+/Md1bD

    Score
    9/10
    bootkitevasionpersistence

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks