General
-
Target
saturnbootsrapper.exe
-
Size
52.2MB
-
Sample
240604-agrsxaec4x
-
MD5
a9e1bc56479e53b1836459e9a9e5c551
-
SHA1
93cdd7964cdbaede24f958d7030d1f6906708a4b
-
SHA256
80c31b93b57a755b509f2ccc4152dbd825e6829eea8675fe18d02948f42bfbda
-
SHA512
0a266e6908916e6a4aa86800dc55a724fcbac64df211cf127d7c0de3db511438ad543954875c4db0cad0732bf69885019799c19b3b6bf9fc2d8de0ebfca4be0e
-
SSDEEP
393216:uWvz+q3VyoyUIC9urEUWj5EnBSVkRIrY87FNlqrMvxmouin93vt6a9kW/W:Pz+q30QdbQzcY87FziMZmylV6BM
Behavioral task
behavioral1
Sample
saturnbootsrapper.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
saturnbootsrapper.exe
-
Size
52.2MB
-
MD5
a9e1bc56479e53b1836459e9a9e5c551
-
SHA1
93cdd7964cdbaede24f958d7030d1f6906708a4b
-
SHA256
80c31b93b57a755b509f2ccc4152dbd825e6829eea8675fe18d02948f42bfbda
-
SHA512
0a266e6908916e6a4aa86800dc55a724fcbac64df211cf127d7c0de3db511438ad543954875c4db0cad0732bf69885019799c19b3b6bf9fc2d8de0ebfca4be0e
-
SSDEEP
393216:uWvz+q3VyoyUIC9urEUWj5EnBSVkRIrY87FNlqrMvxmouin93vt6a9kW/W:Pz+q30QdbQzcY87FziMZmylV6BM
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-