Overview

overview

8

Static

static

3

salinewin-safety.exe

windows10-1703-x64

8

salinewin.exe

windows10-1703-x64

8

Resubmissions

23/02/2024, 10:06

240223-l5dfzafb348

22/02/2024, 21:32

240222-1dt2zafd3z8

22/02/2024, 21:30

240222-1ctptaff924

22/02/2024, 21:25

240222-z9kmqsff588

Sharing

Copy URL Twitter E-mail

General

  • Target
    salinewin.zip
  • Size 203KB
  • Sample240223-l5dfzafb34
  • SHA256 b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bootkitevasionpersistence

Malware Config

Targets

    • Target
      salinewin-safety.exe
    • Size 245KB
    • SHA256 279a19315055e93a80c558bf9d9a7c8b4aba8fc8f8f3e812df8619e959abbcae
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    behavioral1
    • Target
      salinewin.exe
    • Size 283KB
    • SHA256 7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    bootkitevasionpersistence

    • Disables Task Manager via registry modification

      evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral2

MITRE ATT&CK Enterprise v15

Tasks