Overview

overview

7

Static

static

3

cs16_fkuffixgod.exe

windows7-x64

7

cs16_fkuffixgod.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cs16_fkuffixgod.exe

  • Size

    183.3MB

  • Sample

    240525-yhfzssge22

  • MD5

    d74e96c7c85f3371e5ab2cf158567708

  • SHA1

    861e84b66466b96f1398ecedf0631d009375f5dd

  • SHA256

    7aad8cbd493b73e7b8c00c9bf519fc4bf0cffeac6116d0bc934b638183d95ebf

  • SHA512

    dd5404aff43ecde4724a71fae6f1235b64c3535b711df23b8a8446e41f211f2bb1e362e177891d9363fc2b62a94fe20e2e92fbaa35e8701109000f944dc3416f

  • SSDEEP

    3145728:Sxf6x4JWv79BK1XIZ+Xz5MqBKDQ5FzQmQhKxnwlMIcwuJ3MF4a79YWhKt87+c:a6mJu9SXIZ2MqEc5VQPswuJcFr793Kyt

Score
7/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      cs16_fkuffixgod.exe

    • Size

      183.3MB

    • MD5

      d74e96c7c85f3371e5ab2cf158567708

    • SHA1

      861e84b66466b96f1398ecedf0631d009375f5dd

    • SHA256

      7aad8cbd493b73e7b8c00c9bf519fc4bf0cffeac6116d0bc934b638183d95ebf

    • SHA512

      dd5404aff43ecde4724a71fae6f1235b64c3535b711df23b8a8446e41f211f2bb1e362e177891d9363fc2b62a94fe20e2e92fbaa35e8701109000f944dc3416f

    • SSDEEP

      3145728:Sxf6x4JWv79BK1XIZ+Xz5MqBKDQ5FzQmQhKxnwlMIcwuJ3MF4a79YWhKt87+c:a6mJu9SXIZ2MqEc5VQPswuJcFr793Kyt

    Score
    7/10
    bootkitdiscoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks