Overview

overview

8

Static

static

1

FA Installer.bat

windows7-x64

3

FA Installer.bat

windows10-2004-x64

8

FA Installer.bat

windows11-21h2-x64

3

FA Installer.bat

android-9-x86

FA Installer.bat

macos-10.15-amd64

4

FA Installer.bat

ubuntu-20.04-amd64

Resubmissions

21-04-2024 20:52

240421-zn1rtsbc83 7

19-04-2024 15:44

240419-s6n3esgb57 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FA Installer.bat

  • Size

    42KB

  • Sample

    240419-s6n3esgb57

  • MD5

    ac48f9875234a4e5649d152672903198

  • SHA1

    6795362296194a79770a385a1a81efa89c6fe203

  • SHA256

    e5f0efdb833e0b8ec06d88d13039ac9ab2b46a70a26a6c9c07868a79b8f11f62

  • SHA512

    b5a8cf484eca8afde45a78b6768970a3ccd9f4731f4f9a227ac22e02cb3c9c158c8221c136fef191ce9967b2b4bc8c7f4aa6a4310e04dc5e3e5b8b7fc712df44

  • SSDEEP

    768:lnwnjP9zogqnrT9AHuhUcKhnuxGTBmF5p8yJVS5LTf+iA0:FI89nf9tUc+nuxGIFwyKhTf+r0

Score
8/10
androidbootkitevasionlinuxmacospersistence

Malware Config

Targets

    • Target

      FA Installer.bat

    • Size

      42KB

    • MD5

      ac48f9875234a4e5649d152672903198

    • SHA1

      6795362296194a79770a385a1a81efa89c6fe203

    • SHA256

      e5f0efdb833e0b8ec06d88d13039ac9ab2b46a70a26a6c9c07868a79b8f11f62

    • SHA512

      b5a8cf484eca8afde45a78b6768970a3ccd9f4731f4f9a227ac22e02cb3c9c158c8221c136fef191ce9967b2b4bc8c7f4aa6a4310e04dc5e3e5b8b7fc712df44

    • SSDEEP

      768:lnwnjP9zogqnrT9AHuhUcKhnuxGTBmF5p8yJVS5LTf+iA0:FI89nf9tUc+nuxGIFwyKhTf+r0

    Score
    8/10
    bootkitpersistenceevasion

    • Downloads MZ/PE file

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks