Overview

overview

8

Static

static

3

0303b3d544...0e.exe

windows7-x64

8

0303b3d544...0e.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    0303b3d5442d2e741f301fdeb0429c0e

  • Size

    191KB

  • Sample

    231229-y6yvhseha8

  • MD5

    0303b3d5442d2e741f301fdeb0429c0e

  • SHA1

    194720c98ec8e6fd4acad7960d2c52f46cb1f1a7

  • SHA256

    c12be33503e5a24c760a78ab8cf33d32df4adb7a00e2abaa7dfa948b702fa009

  • SHA512

    1e217a6650d0050f6a5d07d483ce9bd45333bfaff685da10f86fc00cb7d430e12e1bc95ab484593631764e61e4760de1cbccf1d3fe73b8b4a2a8b69b3bac45f2

  • SSDEEP

    3072:SKQVflZtXQOPC691553Z1UaFPmgRMNlPTGQQm6ytwZEsrYkK47:MlDQOai15lZ198gWNlPTGQQm6agrd7

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      0303b3d5442d2e741f301fdeb0429c0e

    • Size

      191KB

    • MD5

      0303b3d5442d2e741f301fdeb0429c0e

    • SHA1

      194720c98ec8e6fd4acad7960d2c52f46cb1f1a7

    • SHA256

      c12be33503e5a24c760a78ab8cf33d32df4adb7a00e2abaa7dfa948b702fa009

    • SHA512

      1e217a6650d0050f6a5d07d483ce9bd45333bfaff685da10f86fc00cb7d430e12e1bc95ab484593631764e61e4760de1cbccf1d3fe73b8b4a2a8b69b3bac45f2

    • SSDEEP

      3072:SKQVflZtXQOPC691553Z1UaFPmgRMNlPTGQQm6ytwZEsrYkK47:MlDQOai15lZ198gWNlPTGQQm6agrd7

    Score
    8/10
    bootkitpersistence

    • Sets DLL path for service in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks