Overview

overview

9

Static

static

3

315230e53e...4e.exe

windows7-x64

9

315230e53e...4e.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    315230e53e5fd34341771d46f82c37028f1d784887ae070a2a0b424388753d4e

  • Size

    4.0MB

  • Sample

    240526-g6yfbahg7z

  • MD5

    695c749185d6f024569b86b5f7cb8eef

  • SHA1

    a569e85d9c0b9d589d429053bc279532a69bab4d

  • SHA256

    315230e53e5fd34341771d46f82c37028f1d784887ae070a2a0b424388753d4e

  • SHA512

    43402abf4658faf7adaf3e73a0f45abe66154cb3cad81a88f4362d39b8914129e1c7914716f969a7672416ce491c47d2fadb7b10e82a7b33d6f57bacffddf7a9

  • SSDEEP

    49152:B24oY11v4h6XbJjzEk4rZEQDyBRBBwhAsKYzEqqNcWj4IkvLZxYkxO1AWrWuERV2:5o4d4kFAZE9UhDzEqkcWeLZ+1dwV6cw

Score
9/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      315230e53e5fd34341771d46f82c37028f1d784887ae070a2a0b424388753d4e

    • Size

      4.0MB

    • MD5

      695c749185d6f024569b86b5f7cb8eef

    • SHA1

      a569e85d9c0b9d589d429053bc279532a69bab4d

    • SHA256

      315230e53e5fd34341771d46f82c37028f1d784887ae070a2a0b424388753d4e

    • SHA512

      43402abf4658faf7adaf3e73a0f45abe66154cb3cad81a88f4362d39b8914129e1c7914716f969a7672416ce491c47d2fadb7b10e82a7b33d6f57bacffddf7a9

    • SSDEEP

      49152:B24oY11v4h6XbJjzEk4rZEQDyBRBBwhAsKYzEqqNcWj4IkvLZxYkxO1AWrWuERV2:5o4d4kFAZE9UhDzEqkcWeLZ+1dwV6cw

    Score
    9/10
    bootkitevasionpersistencetrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks