Overview

overview

7

Static

static

7

659d063fd2...26.exe

windows7-x64

7

659d063fd2...26.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    659d063fd2cd5dea7b82cb6e26bf91a7d8497a5b4ff618674bcce7e7f0f3f126

  • Size

    1.5MB

  • Sample

    240526-st5veaba7z

  • MD5

    55f08159479191791ae96c3aebeaad1b

  • SHA1

    000cd76ca355c2d6ed576bc50a71126faca53fdb

  • SHA256

    659d063fd2cd5dea7b82cb6e26bf91a7d8497a5b4ff618674bcce7e7f0f3f126

  • SHA512

    0ee83c55e9c4201c36b95905852e87c4e89c1e1aafd467d08fb735518a64226e7daf85cac8ac630a35a3213b64a78544af3d25d217a99fbf564d830237e20927

  • SSDEEP

    49152:UOvU++JRV15nFM92h3tjJFaW8JHIVBikX:UQU+iRV15nFa2/XaW0HKMY

Score
7/10
bootkitpersistencevmprotect

Malware Config

Targets

    • Target

      659d063fd2cd5dea7b82cb6e26bf91a7d8497a5b4ff618674bcce7e7f0f3f126

    • Size

      1.5MB

    • MD5

      55f08159479191791ae96c3aebeaad1b

    • SHA1

      000cd76ca355c2d6ed576bc50a71126faca53fdb

    • SHA256

      659d063fd2cd5dea7b82cb6e26bf91a7d8497a5b4ff618674bcce7e7f0f3f126

    • SHA512

      0ee83c55e9c4201c36b95905852e87c4e89c1e1aafd467d08fb735518a64226e7daf85cac8ac630a35a3213b64a78544af3d25d217a99fbf564d830237e20927

    • SSDEEP

      49152:UOvU++JRV15nFM92h3tjJFaW8JHIVBikX:UQU+iRV15nFa2/XaW0HKMY

    Score
    7/10
    bootkitpersistencevmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks