Overview

overview

7

Static

static

3

8a1ea983c1...49.exe

windows7-x64

7

8a1ea983c1...49.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    8a1ea983c136357be64b0ae69da109cbda327f7a3fc83de57770d33003e82349

  • Size

    4.6MB

  • Sample

    240418-c8r9vsab9z

  • MD5

    4d86b0961f3fc921f3cc6f1b5c4dc15b

  • SHA1

    a9db4790c53c0f50bcbd13cbf477bc41a4426ca8

  • SHA256

    8a1ea983c136357be64b0ae69da109cbda327f7a3fc83de57770d33003e82349

  • SHA512

    17858e43c19f431d0d1587cee905b971db94d26729c6d98883f07614cc0cfe76765043aaaf255eb68acfb3e98a4f024e4588fdbe756cb02e3139dd7bd4acb7cd

  • SSDEEP

    98304:fBe40bl9dRPenSX5gSoCl0DHDB1dE46V3u/r:03Nenql8L/r

Score
7/10
bootkitpersistence

Malware Config

Targets

    • Target

      8a1ea983c136357be64b0ae69da109cbda327f7a3fc83de57770d33003e82349

    • Size

      4.6MB

    • MD5

      4d86b0961f3fc921f3cc6f1b5c4dc15b

    • SHA1

      a9db4790c53c0f50bcbd13cbf477bc41a4426ca8

    • SHA256

      8a1ea983c136357be64b0ae69da109cbda327f7a3fc83de57770d33003e82349

    • SHA512

      17858e43c19f431d0d1587cee905b971db94d26729c6d98883f07614cc0cfe76765043aaaf255eb68acfb3e98a4f024e4588fdbe756cb02e3139dd7bd4acb7cd

    • SSDEEP

      98304:fBe40bl9dRPenSX5gSoCl0DHDB1dE46V3u/r:03Nenql8L/r

    Score
    7/10
    bootkitpersistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks