d49a4c47cc37cb04eac87f6ee7d3b75bc0d62b99517985b1a4569bf4e794a5b4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RogueKiller_portable64.exe
Size

34.6MB
Sample

240612-kjlpsawdqj
MD5

ee64e4da0e24ce166d29ccdac212e649
SHA1

7f1bd6bae97b99bd09c7a815392418b2c0d98f45
SHA256

d49a4c47cc37cb04eac87f6ee7d3b75bc0d62b99517985b1a4569bf4e794a5b4
SHA512

969f53d5df7a4064710e1c29e468715a54e0a31e996355f7a96f0674fbef7dd93a83b834f2002c4e4d21df3584a488d1da331aee0b4d9dfb28b9ed4b546e0cfb
SSDEEP

393216:7H4nMh4659CCGeN0mADe3tEsSNZJ49bE15JLeimlHtJsv6tWKFdu9CbpJWXM9vR+:xfGlmADe3tEsSNZrePtJWrj5CQchRA

Score

8^/10

bootkit discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  RogueKiller_portable64.exe
- Size
  
  34.6MB
- MD5
  
  ee64e4da0e24ce166d29ccdac212e649
- SHA1
  
  7f1bd6bae97b99bd09c7a815392418b2c0d98f45
- SHA256
  
  d49a4c47cc37cb04eac87f6ee7d3b75bc0d62b99517985b1a4569bf4e794a5b4
- SHA512
  
  969f53d5df7a4064710e1c29e468715a54e0a31e996355f7a96f0674fbef7dd93a83b834f2002c4e4d21df3584a488d1da331aee0b4d9dfb28b9ed4b546e0cfb
- SSDEEP
  
  393216:7H4nMh4659CCGeN0mADe3tEsSNZJ49bE15JLeimlHtJsv6tWKFdu9CbpJWXM9vR+:xfGlmADe3tEsSNZrePtJWrj5CQchRA
Score

8^/10

bootkit persistence spyware stealer discovery
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistencespywarestealer

behavioral2

bootkitdiscoverypersistencespywarestealer