Overview

overview

8

Static

static

7

25eee366bf...c9.exe

windows7-x64

7

25eee366bf...c9.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25eee366bfc5df2863f171c9de0fe6c2ae899e0588fc5485a5be31a3fad93ac9

  • Size

    10.2MB

  • Sample

    240525-xtr1rsfc45

  • MD5

    64868096512b6e0abee29d12645a9077

  • SHA1

    c272a484aca1b52eca12fb565a36d19904fa8c1b

  • SHA256

    25eee366bfc5df2863f171c9de0fe6c2ae899e0588fc5485a5be31a3fad93ac9

  • SHA512

    61cd7bfd7cf959d31193c127a9de94694bdba6fbd5fda73ac24232c136dc49d34887ff983f0ca3a3f20887819730f20399b3ce84c29a79015d8b0e82292b8746

  • SSDEEP

    196608:D5IDVaHSbvxMVl1WDtyvJl2IMizYV0GRvZcDEYtOJzCLg+DJeCk8L+TtWLH:VIFvxW+tyhl2jahtWClzk8OOH

Score
8/10
bootkitpersistenceupxvmprotect

Malware Config

Targets

    • Target

      25eee366bfc5df2863f171c9de0fe6c2ae899e0588fc5485a5be31a3fad93ac9

    • Size

      10.2MB

    • MD5

      64868096512b6e0abee29d12645a9077

    • SHA1

      c272a484aca1b52eca12fb565a36d19904fa8c1b

    • SHA256

      25eee366bfc5df2863f171c9de0fe6c2ae899e0588fc5485a5be31a3fad93ac9

    • SHA512

      61cd7bfd7cf959d31193c127a9de94694bdba6fbd5fda73ac24232c136dc49d34887ff983f0ca3a3f20887819730f20399b3ce84c29a79015d8b0e82292b8746

    • SSDEEP

      196608:D5IDVaHSbvxMVl1WDtyvJl2IMizYV0GRvZcDEYtOJzCLg+DJeCk8L+TtWLH:VIFvxW+tyhl2jahtWClzk8OOH

    Score
    8/10
    bootkitpersistenceupxvmprotect

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks