Overview

overview

8

Static

static

3

0fccdb039e...c9.exe

windows7-x64

8

0fccdb039e...c9.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fccdb039e0fb627716e7aa2fe76d5c9

  • Size

    377KB

  • Sample

    231230-fyqvtsfae3

  • MD5

    0fccdb039e0fb627716e7aa2fe76d5c9

  • SHA1

    0c399b51376fed8f385335244f59726d3622e3d3

  • SHA256

    2ce7005021fd9db68978c5cd02e93174cfb9480cf9713b0f748da82db2a2b599

  • SHA512

    c40ffc2f4a01f013a1db1e1b1291e87fa294466dd8f55213bee8a17c7e8e943100e8bbc400366c8ca45d4eed1dfd6a7505b7ec7b0f3c9cecc7aa64aa44c09cee

  • SSDEEP

    6144:UDeC6ckx/n4UjtEJheJcZLbRJaUogKZoWuxVcJoj8rgG+Tf4BcTDTyFMgSq0lA+V:UtZh7hTRJaUogKtgDcgZf4BcHTwp2hvz

Score
8/10
adwarebootkitpersistencestealer

Malware Config

Targets

    • Target

      0fccdb039e0fb627716e7aa2fe76d5c9

    • Size

      377KB

    • MD5

      0fccdb039e0fb627716e7aa2fe76d5c9

    • SHA1

      0c399b51376fed8f385335244f59726d3622e3d3

    • SHA256

      2ce7005021fd9db68978c5cd02e93174cfb9480cf9713b0f748da82db2a2b599

    • SHA512

      c40ffc2f4a01f013a1db1e1b1291e87fa294466dd8f55213bee8a17c7e8e943100e8bbc400366c8ca45d4eed1dfd6a7505b7ec7b0f3c9cecc7aa64aa44c09cee

    • SSDEEP

      6144:UDeC6ckx/n4UjtEJheJcZLbRJaUogKZoWuxVcJoj8rgG+Tf4BcTDTyFMgSq0lA+V:UtZh7hTRJaUogKtgDcgZf4BcHTwp2hvz

    Score
    8/10
    adwarebootkitpersistencestealer

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks