Overview

overview

8

Static

static

3

Bootstrapper.exe

windows7-x64

3

Bootstrapper.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bootstrapper.exe

  • Size

    795KB

  • Sample

    240801-zytfhawfkr

  • MD5

    a7f3293b177a63f6c50b5560e729cbff

  • SHA1

    4885073e4881cffc5c5155de720aa65755418fe8

  • SHA256

    da17868f107954124c0953fd1cb37ac8ed4e78460905e83d6402b966a77ee7dc

  • SHA512

    70b3431b238457a24e66914d0059e7e8e2dc4f79ac49c9a9c510214b8bc1279af6947288442060ac02c3cf3c863c144ef95219006097d2e59183586f7f701438

  • SSDEEP

    12288:Hs0xF36Z1LyI6QQsJNOoRQ1jt/Nppxu29CHWzO:xxJ6Z1L5J8oRQ1jt/Nppxv9C2

Score
8/10
discovery

Malware Config

Targets

    • Target

      Bootstrapper.exe

    • Size

      795KB

    • MD5

      a7f3293b177a63f6c50b5560e729cbff

    • SHA1

      4885073e4881cffc5c5155de720aa65755418fe8

    • SHA256

      da17868f107954124c0953fd1cb37ac8ed4e78460905e83d6402b966a77ee7dc

    • SHA512

      70b3431b238457a24e66914d0059e7e8e2dc4f79ac49c9a9c510214b8bc1279af6947288442060ac02c3cf3c863c144ef95219006097d2e59183586f7f701438

    • SSDEEP

      12288:Hs0xF36Z1LyI6QQsJNOoRQ1jt/Nppxu29CHWzO:xxJ6Z1L5J8oRQ1jt/Nppxv9C2

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks