Overview

overview

7

Static

static

3

025c6e4968...72.exe

windows7-x64

7

025c6e4968...72.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    025c6e49682fa33cf50939b5899a2972

  • Size

    1.4MB

  • Sample

    231224-r9e39aabgn

  • MD5

    025c6e49682fa33cf50939b5899a2972

  • SHA1

    0585d2ed5f5d1ef54358df7c349e979129c70145

  • SHA256

    e3bfe126d7729c2c262c4338b12139b1c09995c39585d4351e39f045ee748bfd

  • SHA512

    e7d6aa4c6abdbb5c22d0d71e057cb12f539583cf1b411cdbe0aedf7783eb7315aab24a2cd3f2805561dbb9a1209302dd62a46c38f2271adc90833b2915fc1419

  • SSDEEP

    24576:m7hOlzuwzf6YxYr5mp/Snnr27KmPKfuSJdBZRC3hxlQgJ8SS6dYrwFCk8:MOkQ6Y05Lnr3mPKfrJ9E3ueTpdYr28

Score
7/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      025c6e49682fa33cf50939b5899a2972

    • Size

      1.4MB

    • MD5

      025c6e49682fa33cf50939b5899a2972

    • SHA1

      0585d2ed5f5d1ef54358df7c349e979129c70145

    • SHA256

      e3bfe126d7729c2c262c4338b12139b1c09995c39585d4351e39f045ee748bfd

    • SHA512

      e7d6aa4c6abdbb5c22d0d71e057cb12f539583cf1b411cdbe0aedf7783eb7315aab24a2cd3f2805561dbb9a1209302dd62a46c38f2271adc90833b2915fc1419

    • SSDEEP

      24576:m7hOlzuwzf6YxYr5mp/Snnr27KmPKfuSJdBZRC3hxlQgJ8SS6dYrwFCk8:MOkQ6Y05Lnr3mPKfrJ9E3ueTpdYr28

    Score
    7/10
    bootkitevasionpersistencetrojan

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks