Overview

overview

9

Static

static

3

5290d2b1a7...f8.exe

windows7-x64

9

5290d2b1a7...f8.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8

  • Size

    4.1MB

  • Sample

    240526-nsdbjshf47

  • MD5

    582df70d236638d6d5724b6c0e599033

  • SHA1

    5b225fcec25a935432a1e4db3ca307c3bf29c55d

  • SHA256

    5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8

  • SHA512

    66870e15b7bcccacc0861bce6a6da89d061b710eaca4cc53a8fb6fa92dc7969d8b8064c5c87f8c958b2d9acd7bb69059e828ca14f4b1384bb8e896a91d686f4e

  • SSDEEP

    98304:suKyLxLVExj+VT9BfLUR9ne7diVFJyBWt9ZpZVLo/ekb2B8bPb:szyLZEjG9Z4Rd6gcipLLdkbGUz

Score
9/10
bootkitevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8

    • Size

      4.1MB

    • MD5

      582df70d236638d6d5724b6c0e599033

    • SHA1

      5b225fcec25a935432a1e4db3ca307c3bf29c55d

    • SHA256

      5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8

    • SHA512

      66870e15b7bcccacc0861bce6a6da89d061b710eaca4cc53a8fb6fa92dc7969d8b8064c5c87f8c958b2d9acd7bb69059e828ca14f4b1384bb8e896a91d686f4e

    • SSDEEP

      98304:suKyLxLVExj+VT9BfLUR9ne7diVFJyBWt9ZpZVLo/ekb2B8bPb:szyLZEjG9Z4Rd6gcipLLdkbGUz

    Score
    9/10
    bootkitevasionpersistencetrojanupx

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks