5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

5290d2b1a7...f8.exe

windows7-x64

9

5290d2b1a7...f8.exe

windows10-2004-x64

9

Sharing

General

Target

5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8
Size

4.1MB
Sample

240526-nsdbjshf47
MD5

582df70d236638d6d5724b6c0e599033
SHA1

5b225fcec25a935432a1e4db3ca307c3bf29c55d
SHA256

5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8
SHA512

66870e15b7bcccacc0861bce6a6da89d061b710eaca4cc53a8fb6fa92dc7969d8b8064c5c87f8c958b2d9acd7bb69059e828ca14f4b1384bb8e896a91d686f4e
SSDEEP

98304:suKyLxLVExj+VT9BfLUR9ne7diVFJyBWt9ZpZVLo/ekb2B8bPb:szyLZEjG9Z4Rd6gcipLLdkbGUz

Score

9^/10

bootkit evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8.exe

Resource

win7-20240508-en

bootkit evasion persistence trojan upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8.exe

Resource

win10v2004-20240508-en

bootkit evasion persistence trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8
- Size
  
  4.1MB
- MD5
  
  582df70d236638d6d5724b6c0e599033
- SHA1
  
  5b225fcec25a935432a1e4db3ca307c3bf29c55d
- SHA256
  
  5290d2b1a7abbbaa500b421d32d53fd4d5a1fd149bb3c65700afb65f09c3b3f8
- SHA512
  
  66870e15b7bcccacc0861bce6a6da89d061b710eaca4cc53a8fb6fa92dc7969d8b8064c5c87f8c958b2d9acd7bb69059e828ca14f4b1384bb8e896a91d686f4e
- SSDEEP
  
  98304:suKyLxLVExj+VT9BfLUR9ne7diVFJyBWt9ZpZVLo/ekb2B8bPb:szyLZEjG9Z4Rd6gcipLLdkbGUz
Score

9^/10

bootkit evasion persistence trojan upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistencetrojanupx

behavioral2

bootkitevasionpersistencetrojan

© 2018-2025

Terms | Privacy