5500e4fc11f4a00fcc1331f4f6c742f3fae37c6efb73cf375a0782f9e7471af0 | Triage

Sharing

General

Target

105cfe7ca8bc51dca53ce41495c8dc19
Size

644KB
Sample

231230-ghjbgsadb8
MD5

105cfe7ca8bc51dca53ce41495c8dc19
SHA1

b4aa890e6b681b72cea1407c03059dac215e2ad0
SHA256

5500e4fc11f4a00fcc1331f4f6c742f3fae37c6efb73cf375a0782f9e7471af0
SHA512

8ff5a7f584d29127cca381e9e7acbdef841ff37b016aec2104d25999c4322c34aadc9d2ceed0f57da3e896ca6d1c9e52da1560beff115f3e7f5da3dd299e8896
SSDEEP

12288:sazsnknE9v1H9RpCbouyoEsD95S+DcpezVtnR+GjtNj4xb5NP:sazsnknE9tTpFuyoEuM+wanUGjH4V5NP

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  ASP本地调试.exe
- Size
  
  633KB
- MD5
  
  e1e582720d4ca2378f941886522dd8d4
- SHA1
  
  00d2170ef00a0570af6bdae17e9283f0acc284e0
- SHA256
  
  8210a79289dd3e351bd6e57318d2cbf4f69cacd028d8e4b352470c4515230380
- SHA512
  
  b667f722afd1cd2d2349ee2b1b0f29e7bbbac73ed9f1018c2b5280cf0a07206576a05de46d40639c02fd37dac38f287f5b4288f25a709c4aa8baee1be4c49668
- SSDEEP
  
  12288:JJFZqYMOaQ0q9nV/zsnK23KHVI6nodVdyMLiqyVcxwtVxgpMiuzOT6d:fFZqhOBnVyK23C6OoYMLiVcKtVx4Miud
Score

6^/10

bootkit persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  
  dm/all.asp
- Size
  
  556B
- MD5
  
  f71a3f4c28980eecf1ac91e34d95add8
- SHA1
  
  bc0b6448405c04cb807d12f7ea246dd40aad0890
- SHA256
  
  35a6ef39c5797e8996a26be4875cdd181d2ad37e85261ffb77578afa94172fd7
- SHA512
  
  c4add46c8061d30682d5ff15a3f128fa6189ba9e1fdca999f4a59573a9f61d04efae52603f15f9e90914b3341669607802ca8a41742680ddf9a0efd6036fe5ce
Score

3^/10
behavioral3 behavioral4
- Target
  
  dm/config.asp
- Size
  
  476B
- MD5
  
  2d29e3861636cf1d14c1fe41599343ae
- SHA1
  
  034c7440abce14f0120ab054e23b299add3248f7
- SHA256
  
  73cdf8b656363c89174a05b44d85835b72b6087bce8cfdfcefb6c27f566dd03b
- SHA512
  
  ca93ebbfe40a63c75164803eb5e177bf55b1c0551195b39d90b53774d33efb7d1e0b633e7cc7577cb7934567f49dfd6d894d27ea24cd07055724703cdb7002c5
Score

3^/10
behavioral5 behavioral6
- Target
  
  dm/function.asp
- Size
  
  3KB
- MD5
  
  651204426f7d23c03a6c041d6b0ff4e2
- SHA1
  
  b8ba2521b710e8464f9c0956532b3d355f2c618f
- SHA256
  
  50552730c739461568b91149d1940801250b21961e6ae9cad6a983293a730b79
- SHA512
  
  455b68ebc7e6c8930322b05e687998f6ff723ffe9d721ef973a07edf2ada5864ca7dfa663a552014a09c13f9ad5c390f3ee5216b728f5b30abc86250ff23cebd
Score

1^/10
behavioral7 behavioral8
- Target
  
  dm/html/index.asp
- Size
  
  1KB
- MD5
  
  9aa9071d4d36fca4455711718bb34dd0
- SHA1
  
  8e3b73f3e12e1e2f125f8cb81ce68966f161cde4
- SHA256
  
  09bf7e3402a57491f4ced8e2892cf9121a3c149b3d1801993f6a6ae10c2c63af
- SHA512
  
  4bd6d88a84c18a13da440866471b071a19f8c3ee0547d23cca07429f6a1f014f9475ac9893d753e2b281a13ba2200bcd3e751dc84dce0e74eb1ac02faf4e8e93
Score

3^/10
behavioral10 behavioral9
- Target
  
  dm/images/addPage.js
- Size
  
  2KB
- MD5
  
  64212e954d0d099d36d3032acf84109f
- SHA1
  
  540ed43f8757be41d9ea0ce8516f1526fa52f8e1
- SHA256
  
  e3c19d72d3ec4c6723a9ba4051e1db26d39ea7507c453006c7ff275ffc1447fd
- SHA512
  
  3360dcb2c311bd6416f82cd4257753e7dc5035eab24e561fba4478268941b6751cb8954135a5815f9eec1fc13c4a9706db50146fe79ed753d2a51f39b970f8f6
Score

1^/10
behavioral11 behavioral12
- Target
  
  dm/images/bot760.js
- Size
  
  2B
- MD5
  
  7bc0ee636b3b83484fc3b9348863bd22
- SHA1
  
  ebbffb7d7ea5362a22bfa1bab0bfdeb1617cd610
- SHA256
  
  a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
- SHA512
  
  4d094b64124366530e7e327b1ad5d06c0fd1ceb96387d6a143e9f561c2f9ff7ca9d68e7c23b8b14aab5309c202a8dced9a38d950662a50984d2841577293cd64
Score

1^/10
behavioral13 behavioral14
- Target
  
  dm/images/center400.js
- Size
  
  298B
- MD5
  
  168ddaac7feb1363ca9069e9fe92581e
- SHA1
  
  dd64cbb764e298a93bc7b03ead2727d5f6bdc4da
- SHA256
  
  694c44e14ffef7e00dec723415bdafe47917f82070a9336a0d832447bb8b2ce8
- SHA512
  
  7f9610376000daed582c71de863f62d709e6d550b05758b0dfba00ca928a196bf52d635762be0edc38992b150a96c7baa6e520a8494d9203aa1d644fdc7d7105
Score

1^/10
behavioral15 behavioral16
- Target
  
  dm/images/check_player.js
- Size
  
  1KB
- MD5
  
  36b09995fd2f67ece5c21d81b2f229b0
- SHA1
  
  b07f8a7793445b41a0644b7e28e2eb9ab7febf03
- SHA256
  
  8d6cc4b76bde87cd977f98452bf234134c09491d204ae56694790369ceb5e1a1
- SHA512
  
  694daf0ccd89f29e871a75b13fc105469c99b84f916ca0faa0cdfd176850c21977d2dbf0a5f65e07ed0b3247595eef36759dcb187b33a1f9e534d028e5cb51ed
Score

1^/10
behavioral17 behavioral18
- Target
  
  dm/images/foot.js
- Size
  
  63B
- MD5
  
  d9b77cdacb59b4c55d9f206fa9a26549
- SHA1
  
  08df6004fc08f63498969d7568b8c673ff0fd81b
- SHA256
  
  0a83a552e6847de2f376e9ee69b4cfbd797a6c6183bc0e4096b977fa2b01b1d0
- SHA512
  
  625ba47c6638849d22e6ab21333842231eeb40364f4c267bf02cdb6cb54389e905ffe5750289a3a7f7cd7775f7548a6b2d91cf62e58e250ca0ec30835e8b68ea
Score

1^/10
behavioral19 behavioral20
- Target
  
  dm/images/fun.js
- Size
  
  576B
- MD5
  
  15c16d1d71a32e3ff30035e8d80c2d2d
- SHA1
  
  3d04d268898ffc3885736c8e92c8b907bf640682
- SHA256
  
  ce03a8367ed00426e1c43c71ffb8003ecbd98331484b68358f862d687ba0e927
- SHA512
  
  7b0b93e7465524628b1fb48e08537022787c01254dcbd3dee9cf8b1cb1f0afb20125f2440ad8ac54637b019de647558d9141ea2dbd5becd43a40a4f95f804bd9
Score

1^/10
behavioral21 behavioral22
- Target
  
  dm/images/list.js
- Size
  
  135B
- MD5
  
  3e28b25da471a47b644dc745f8f5135f
- SHA1
  
  c8d72543b27e2a61f15c4bc6c1c3dba38240ae42
- SHA256
  
  bfd1513ffdb9cb74c4d6b71fb7b09d6d3fce98bd864258de3cc7954d709d7661
- SHA512
  
  0677d01ad4fc1c286dbb9ef9e7bfd1c086232eeb447b899d21cc33893d75903719a3b4d52a7b8c892f3bb2e3437f9df2374ffa91c4ee4bebc9c4253df4bda6e6
Score

1^/10
behavioral23 behavioral24
- Target
  
  dm/images/top468.js
- Size
  
  1KB
- MD5
  
  6a26ab495b2cf4923bda7e2ad914ac88
- SHA1
  
  7cdcbcb9293c88693f25886d21d772e876fb22d4
- SHA256
  
  55f4e4478cfc60f6e841e1af2fbe513b94c112803ed97bd294ce0f05c0c97bef
- SHA512
  
  c85e6d5406c920f4810102e4504a4cc432adcbaa6b85e48aec1ed03ce46f026421bf77696db2c424f01c48d925d7ae892e824c654a1d1824e1db654f16f14cba
Score

1^/10
behavioral25 behavioral26
- Target
  
  dm/images/top760.js
- Size
  
  1KB
- MD5
  
  d93ab1ebde13856f1e9c04860b8cff30
- SHA1
  
  29954b301858d53031bfe07ecbb7fed04148dd47
- SHA256
  
  554ffb98532fa9fe0d63f86fb5f8aa330433adcf373cf66e266c73466b93364f
- SHA512
  
  8c3055d6b7e00b9054fb15396a0ad145175272e38660dedda2967b4c2938d261f228d496d8bad9fd50b480b10aa79f02d88053498b6990eaf6ffb4792fdb0a65
Score

1^/10
behavioral27 behavioral28
- Target
  
  dm/index.asp
- Size
  
  625B
- MD5
  
  e4a41a8709e1e455368b3df6ebf750f6
- SHA1
  
  f399fd955f5272fcd1f4438c0fedbabd3c092b0f
- SHA256
  
  7876d8757c1cfe383c809d55e5111e4097ddfb8994327d7f5cf712cd1018de2f
- SHA512
  
  8ec1e7c12cdedff1c80cea44d0a4a228b8eb56af3f2b811c54d576abbe6c2183b9b16d478edefdc320e30f0c4d53da85dad50bd4dd3b8e2aaa7c7e713e03bcb1
Score

3^/10
behavioral29 behavioral30
- Target
  
  dm/index.htm
- Size
  
  46KB
- MD5
  
  86e04c8bcdf7d0687a2d0ea30e550c1b
- SHA1
  
  c0833f8526cdd1522b78285d080a8e80b309eec3
- SHA256
  
  78a3ca3c17b53e1d0393b1d5f2102a857a6a992f68839f742841088e2aa07819
- SHA512
  
  3f753f2774c7b05f52bdaf734b133d30c44f53cc22376c03596d6f80fd0318038e01e4991c3ddf696f9032ea5339b1c844c1cd22d236e8b9c241583b2f9ddd04
- SSDEEP
  
  384:zwOOLHV2oRuej2qDuRkTa/NX0+DhCrEPFD2/WdeezSRazwiR5Djj+5DeSgmp/1Tt:CBDuRkTk0+DSDWmd1hz
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32