Overview

overview

7

Static

static

7

af3150462e...54.exe

windows7-x64

7

af3150462e...54.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af3150462eea98b5e3c7a8bc08ef62b7641d9fe96cc464c851fd74cebf87ee54

  • Size

    1.4MB

  • Sample

    240524-t6epescf56

  • MD5

    a9c11049f1ede0225dac68f96c37fdf3

  • SHA1

    4f26c7ea18895ddf02e35ce376aaf48c04a4ce28

  • SHA256

    af3150462eea98b5e3c7a8bc08ef62b7641d9fe96cc464c851fd74cebf87ee54

  • SHA512

    d7c2d2ad6bae2f1fd5518e2b5c33e59e8f642b2307bec75faff86e65c87f4dfff4b74f06f0ad31e9c4533f7b7acb6ad895d5ce2d88402bf1aac7543414718555

  • SSDEEP

    24576:MfSDKK9C9pLmPET243ZlpZOTy+it8Po/olPhA8sEXSFjQG9xmreCmU+9i:YS1eV64Jelit8QAlPhfsq8jRISCk9i

Score
7/10
bootkitpersistencespywarestealerupx

Malware Config

Targets

    • Target

      af3150462eea98b5e3c7a8bc08ef62b7641d9fe96cc464c851fd74cebf87ee54

    • Size

      1.4MB

    • MD5

      a9c11049f1ede0225dac68f96c37fdf3

    • SHA1

      4f26c7ea18895ddf02e35ce376aaf48c04a4ce28

    • SHA256

      af3150462eea98b5e3c7a8bc08ef62b7641d9fe96cc464c851fd74cebf87ee54

    • SHA512

      d7c2d2ad6bae2f1fd5518e2b5c33e59e8f642b2307bec75faff86e65c87f4dfff4b74f06f0ad31e9c4533f7b7acb6ad895d5ce2d88402bf1aac7543414718555

    • SSDEEP

      24576:MfSDKK9C9pLmPET243ZlpZOTy+it8Po/olPhA8sEXSFjQG9xmreCmU+9i:YS1eV64Jelit8QAlPhfsq8jRISCk9i

    Score
    7/10
    bootkitpersistencespywarestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks