Overview

overview

10

Static

static

1

2024-05-09...il.exe

windows7-x64

10

2024-05-09...il.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-09_4043a9ea54c94b3bbf92ef312f004fef_avoslocker_magniber_revil

  • Size

    5.2MB

  • Sample

    240509-wpdf5sfc4w

  • MD5

    4043a9ea54c94b3bbf92ef312f004fef

  • SHA1

    040b783cea7bad532c7c1435a7d2d09afbafbb08

  • SHA256

    35146a3795c50e229be65d164d793ffb2af695f75902e0d28ee992fdc51b12a7

  • SHA512

    d93586cea0f30e7873f8ca02c9336a24e5c17b512cb45833578fd6959ed0072afaa7eaf08d7d7ac212de7a3895806fc527fd72e298679e1199b4054d9e88ea69

  • SSDEEP

    98304:s9Ns5TDi1FXQct/iAj185SHiX3vks8Uu50GPxluKMWRhNmAS/Bsk7O:sgTDi1FXQct/iAj185SCX850ixFRhNXj

Score
10/10
bruteratelprivateloaderbackdoorbootkitdiscoveryevasionloaderpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      2024-05-09_4043a9ea54c94b3bbf92ef312f004fef_avoslocker_magniber_revil

    • Size

      5.2MB

    • MD5

      4043a9ea54c94b3bbf92ef312f004fef

    • SHA1

      040b783cea7bad532c7c1435a7d2d09afbafbb08

    • SHA256

      35146a3795c50e229be65d164d793ffb2af695f75902e0d28ee992fdc51b12a7

    • SHA512

      d93586cea0f30e7873f8ca02c9336a24e5c17b512cb45833578fd6959ed0072afaa7eaf08d7d7ac212de7a3895806fc527fd72e298679e1199b4054d9e88ea69

    • SSDEEP

      98304:s9Ns5TDi1FXQct/iAj185SHiX3vks8Uu50GPxluKMWRhNmAS/Bsk7O:sgTDi1FXQct/iAj185SCX850ixFRhNXj

    Score
    10/10
    privateloaderbootkitdiscoveryevasionloaderpersistencespywarestealertrojanbruteratelbackdoor

    • Brute Ratel C4

      A customized command and control framework for red teaming and adversary simulation.

      backdoorbruteratel

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

3
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks