General

  • Target

    f814ee32fdd8add6a11b7035de91f8f7

  • Size

    16.4MB

  • Sample

    231228-zwsq7aaba9

  • MD5

    f814ee32fdd8add6a11b7035de91f8f7

  • SHA1

    e06f544ec388a560375a09d8d2081575d13cac58

  • SHA256

    ac9f98a1d583b205db0f3d1457464ddf0208fd61a18ba7851400b50271b0b199

  • SHA512

    1137fcb49d52c8a8ca5670056eb9b94d6ba7306d047ab1208320efb4809ca84a67515ca3eaac357e55b55daabb9bf9924a7abf2217f542f0be5b3119fd371fde

  • SSDEEP

    393216:mM/YiZ6wVdXjs5lodwpiqMUGul1VYZJEx4nXvWg9gzD+:EHuWmGYulPKJPvA+

Malware Config

Targets

    • Target

      f814ee32fdd8add6a11b7035de91f8f7

    • Size

      16.4MB

    • MD5

      f814ee32fdd8add6a11b7035de91f8f7

    • SHA1

      e06f544ec388a560375a09d8d2081575d13cac58

    • SHA256

      ac9f98a1d583b205db0f3d1457464ddf0208fd61a18ba7851400b50271b0b199

    • SHA512

      1137fcb49d52c8a8ca5670056eb9b94d6ba7306d047ab1208320efb4809ca84a67515ca3eaac357e55b55daabb9bf9924a7abf2217f542f0be5b3119fd371fde

    • SSDEEP

      393216:mM/YiZ6wVdXjs5lodwpiqMUGul1VYZJEx4nXvWg9gzD+:EHuWmGYulPKJPvA+

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks