Overview

overview

8

Static

static

1

MEMZ-virus

windows10-2004-x64

8

Resubmissions

14/03/2024, 13:57

240314-q9hzgafh76 1

14/03/2024, 13:54

240314-q7qljadg2w 8

Sharing

Copy URL Twitter E-mail

General

  • Target

    MEMZ-virus

  • Size

    216KB

  • Sample

    240314-q7qljadg2w

  • MD5

    950187b75e7dabe6704158b48e4705d4

  • SHA1

    9672343e07d0fcd3cf1ed941041229b78cfbcc44

  • SHA256

    8b831cf37263195e6a6b39b7de6b70b9e398546f369375ecce3fd839b051836d

  • SHA512

    450c54a71b13e9837f89e6d525a8437de0ae252496bf38e7279e36910a47810c1b1c0bd2af9a3f0f66feb39bb1a456289b6a6f14478f01d904c75d56663a4a54

  • SSDEEP

    6144:ybDuqJAfWeVSgE29xxspm0n1vuz3O9QvZJT3CqbMrhryfQNRPaCieMjAkvCJv1V9:ycfWeVSgE29xxspm0n1vuz3O9QvZJT3m

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      MEMZ-virus

    • Size

      216KB

    • MD5

      950187b75e7dabe6704158b48e4705d4

    • SHA1

      9672343e07d0fcd3cf1ed941041229b78cfbcc44

    • SHA256

      8b831cf37263195e6a6b39b7de6b70b9e398546f369375ecce3fd839b051836d

    • SHA512

      450c54a71b13e9837f89e6d525a8437de0ae252496bf38e7279e36910a47810c1b1c0bd2af9a3f0f66feb39bb1a456289b6a6f14478f01d904c75d56663a4a54

    • SSDEEP

      6144:ybDuqJAfWeVSgE29xxspm0n1vuz3O9QvZJT3CqbMrhryfQNRPaCieMjAkvCJv1V9:ycfWeVSgE29xxspm0n1vuz3O9QvZJT3m

    Score
    8/10
    bootkitpersistence

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks