cab445a0687a576ce30d1025dad52d36672aba94c0f6acfcf19b31ef4b9d44d8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a76a616213578352655baa8ec670a4af.bin
Size

154KB
Sample

240228-ckhqhsgg6z
MD5

a76a616213578352655baa8ec670a4af
SHA1

c49b7edec8d11906c6b9239b35ae3d9faaa75774
SHA256

cab445a0687a576ce30d1025dad52d36672aba94c0f6acfcf19b31ef4b9d44d8
SHA512

9eafa5e2207467b3062f5d031102d9d44c5d0c223a45c4033ea4701f97522a4a7c77d9d6001030b36143126252a87f85d300665ef73e4fa559121468d1e720b2
SSDEEP

3072:lK4X93xxRCcmwwOs2r/UlpyYreyzukwFrLlX+Sxd:l2OBoTdr03FrpX+od

Score

10^/10

bootkit evasion persistence trojan

Malware Config

Targets

- Target
  
  a76a616213578352655baa8ec670a4af.bin
- Size
  
  154KB
- MD5
  
  a76a616213578352655baa8ec670a4af
- SHA1
  
  c49b7edec8d11906c6b9239b35ae3d9faaa75774
- SHA256
  
  cab445a0687a576ce30d1025dad52d36672aba94c0f6acfcf19b31ef4b9d44d8
- SHA512
  
  9eafa5e2207467b3062f5d031102d9d44c5d0c223a45c4033ea4701f97522a4a7c77d9d6001030b36143126252a87f85d300665ef73e4fa559121468d1e720b2
- SSDEEP
  
  3072:lK4X93xxRCcmwwOs2r/UlpyYreyzukwFrLlX+Sxd:l2OBoTdr03FrpX+od
Score

10^/10

bootkit evasion persistence trojan
- Modifies firewall policy service
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistencetrojan

behavioral2

bootkitevasionpersistencetrojan