Overview

overview

7

Static

static

3

Cohr.exe

windows7-x64

7

Cohr.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cohr.exe

  • Size

    1.9MB

  • Sample

    240529-srqygabb29

  • MD5

    f63c3b09477f0fd95a747f9491044923

  • SHA1

    572d425610224a7f9e8874abd2b0b7d76cd22bf2

  • SHA256

    d635449c54ead00d629bc05c87146b3942375cc67b4726c31ea6a3dfbe298fbc

  • SHA512

    88256ff18ba5583a06fe6bf096afc53e458b547ccc48c81d2b903b32409b4a1ff25cb28f731168212a21d734425196e4d6bb14c09548ded1c8524d34e23150a7

  • SSDEEP

    24576:sHnaHPB9cf8XFqztAWByVFdk52o/pQ0WfMQ1jEqpFfrRV+:BH59cf8XFqztAWByVFdOF/Gn1YIdrRV+

Score
7/10
bootkitpersistence

Malware Config

Targets

    • Target

      Cohr.exe

    • Size

      1.9MB

    • MD5

      f63c3b09477f0fd95a747f9491044923

    • SHA1

      572d425610224a7f9e8874abd2b0b7d76cd22bf2

    • SHA256

      d635449c54ead00d629bc05c87146b3942375cc67b4726c31ea6a3dfbe298fbc

    • SHA512

      88256ff18ba5583a06fe6bf096afc53e458b547ccc48c81d2b903b32409b4a1ff25cb28f731168212a21d734425196e4d6bb14c09548ded1c8524d34e23150a7

    • SSDEEP

      24576:sHnaHPB9cf8XFqztAWByVFdk52o/pQ0WfMQ1jEqpFfrRV+:BH59cf8XFqztAWByVFdOF/Gn1YIdrRV+

    Score
    7/10
    bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks