Overview

overview

7

Static

static

7

b443aa0b52...ff.exe

windows7-x64

7

b443aa0b52...ff.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b443aa0b52bd2cfc6bf13c007b9753ff

  • Size

    12.3MB

  • Sample

    240305-kfh5gsaf6z

  • MD5

    b443aa0b52bd2cfc6bf13c007b9753ff

  • SHA1

    21d58a5038ae7d72183a7dd72395cd645b2fa4c5

  • SHA256

    e06cd01976f49892d4d735ee1f82bc45f4cf24c60435e1053e6e073a3d6c98f0

  • SHA512

    7f6a7e69f2c98c334ed3d1044ee42113f2636690a9032b1db6c950b9fbcb020343397ba38550fed3a37fdcf75f0ae1984e84c490f54ffb4e177adc02fba6d2c0

  • SSDEEP

    393216:T1IfOrJRIeAq5FpoqapGWoeALVTqEkwBzzxr+IVfvKu:yM6mFkoDLUOzh3

Score
7/10
bootkitpersistencevmprotect

Malware Config

Targets

    • Target

      b443aa0b52bd2cfc6bf13c007b9753ff

    • Size

      12.3MB

    • MD5

      b443aa0b52bd2cfc6bf13c007b9753ff

    • SHA1

      21d58a5038ae7d72183a7dd72395cd645b2fa4c5

    • SHA256

      e06cd01976f49892d4d735ee1f82bc45f4cf24c60435e1053e6e073a3d6c98f0

    • SHA512

      7f6a7e69f2c98c334ed3d1044ee42113f2636690a9032b1db6c950b9fbcb020343397ba38550fed3a37fdcf75f0ae1984e84c490f54ffb4e177adc02fba6d2c0

    • SSDEEP

      393216:T1IfOrJRIeAq5FpoqapGWoeALVTqEkwBzzxr+IVfvKu:yM6mFkoDLUOzh3

    Score
    7/10
    bootkitpersistencevmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks