52e1e153529fd413b55c861c36b00d034c0efdadcb05b4cb820dbc1d85bac83b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

52e1e153529fd413b55c861c36b00d034c0efdadcb05b4cb820dbc1d85bac83b
Size

2.4MB
Sample

240527-yn88jahc62
MD5

66d1eda403d7903e0ae377a64519fbbd
SHA1

fb11af0e714e99006c26a0b1c46bf431df8b5c6f
SHA256

52e1e153529fd413b55c861c36b00d034c0efdadcb05b4cb820dbc1d85bac83b
SHA512

4cf5e9f972e7850d05dc634794f66ad23338374250a2f6f19ece21327da5d4c264cc14c77ff6f14ecaa1f423c4f93c4c6409d28473ba84258a09d77afedccf2f
SSDEEP

49152:JoNgRf9tTkvqHWzKVcBd6o6nt2rK09G4lyo0ZacSiLUswRI/CIJv:J+Qf7cqA0bt2rK09cohiLUbQJJv

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  52e1e153529fd413b55c861c36b00d034c0efdadcb05b4cb820dbc1d85bac83b
- Size
  
  2.4MB
- MD5
  
  66d1eda403d7903e0ae377a64519fbbd
- SHA1
  
  fb11af0e714e99006c26a0b1c46bf431df8b5c6f
- SHA256
  
  52e1e153529fd413b55c861c36b00d034c0efdadcb05b4cb820dbc1d85bac83b
- SHA512
  
  4cf5e9f972e7850d05dc634794f66ad23338374250a2f6f19ece21327da5d4c264cc14c77ff6f14ecaa1f423c4f93c4c6409d28473ba84258a09d77afedccf2f
- SSDEEP
  
  49152:JoNgRf9tTkvqHWzKVcBd6o6nt2rK09G4lyo0ZacSiLUswRI/CIJv:J+Qf7cqA0bt2rK09cohiLUbQJJv
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2