b1266ca5c256fe6e7aad8ec9659844dcb6972528ee4f1b5774f273ecf8d1ec38 | Triage

Sharing

General

Target

ReboundBootstrapper.exe
Size

11KB
Sample

240612-he57hstamq
MD5

26e2168900db2b48c50c75027388357b
SHA1

9b7c831760920070e4454b7e40e3cdfe6a29a4c1
SHA256

b1266ca5c256fe6e7aad8ec9659844dcb6972528ee4f1b5774f273ecf8d1ec38
SHA512

46d2069244cf5efe8be2a9b2423554e268a2eda2ff3ff0edc09ef02eaafbeaeefd723343c8455ddb5d2a417fd66b73c099b2f27a901655f6cc0ddf963a86d407
SSDEEP

192:cFtRQo7hDOFRPQc3IUIaJaLLmDXKu0i3TJfg9F7VXjDNjA:cFfYaUIaJaeDKDitfgb7VNj

Score

7^/10

Malware Config

Targets

- Target
  
  ReboundBootstrapper.exe
- Size
  
  11KB
- MD5
  
  26e2168900db2b48c50c75027388357b
- SHA1
  
  9b7c831760920070e4454b7e40e3cdfe6a29a4c1
- SHA256
  
  b1266ca5c256fe6e7aad8ec9659844dcb6972528ee4f1b5774f273ecf8d1ec38
- SHA512
  
  46d2069244cf5efe8be2a9b2423554e268a2eda2ff3ff0edc09ef02eaafbeaeefd723343c8455ddb5d2a417fd66b73c099b2f27a901655f6cc0ddf963a86d407
- SSDEEP
  
  192:cFtRQo7hDOFRPQc3IUIaJaLLmDXKu0i3TJfg9F7VXjDNjA:cFfYaUIaJaeDKDitfgb7VNj
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2