Overview

overview

10

Static

static

10

5d214ba916...27.exe

windows7-x64

7

5d214ba916...27.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5d214ba9162c66fdaedcaefec9312c2cb5b276f121aa7e86a5e4dd247361d127

  • Size

    3.4MB

  • Sample

    240515-dth83sfa29

  • MD5

    07891e8f46fd9d40a124c1302832a2d6

  • SHA1

    108886b3951463b7417b8907ff0ae1c95dfbdff7

  • SHA256

    5d214ba9162c66fdaedcaefec9312c2cb5b276f121aa7e86a5e4dd247361d127

  • SHA512

    bf326d8ddda65099562420f50262c146ee0db5218bdd54622289231fd1aaedc3d90b2330137a82528b7754866c111ea30d8f010f822a32a751d4dbf85d6bd6b8

  • SSDEEP

    49152:3EjEamQb2OguN8Dfk5JEG14wv2QwnN4iTapOcaPKfjtD8cEOxeuxzS2hPV5T1gWM:3EjlmQbfgSgwvSnN4iVJuS0xVLQEoeqL

Score
10/10
gozibootkitisfbpersistence

Malware Config

Extracted

Family

gozi

Targets

    • Target

      5d214ba9162c66fdaedcaefec9312c2cb5b276f121aa7e86a5e4dd247361d127

    • Size

      3.4MB

    • MD5

      07891e8f46fd9d40a124c1302832a2d6

    • SHA1

      108886b3951463b7417b8907ff0ae1c95dfbdff7

    • SHA256

      5d214ba9162c66fdaedcaefec9312c2cb5b276f121aa7e86a5e4dd247361d127

    • SHA512

      bf326d8ddda65099562420f50262c146ee0db5218bdd54622289231fd1aaedc3d90b2330137a82528b7754866c111ea30d8f010f822a32a751d4dbf85d6bd6b8

    • SSDEEP

      49152:3EjEamQb2OguN8Dfk5JEG14wv2QwnN4iTapOcaPKfjtD8cEOxeuxzS2hPV5T1gWM:3EjlmQbfgSgwvSnN4iVJuS0xVLQEoeqL

    Score
    7/10
    bootkitpersistence

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks