General

  • Target

    BootstrapperV1.11.exe

  • Size

    75.5MB

  • Sample

    240802-w4zb6azdrd

  • MD5

    323317d95b40b3d5b1534611110ad12f

  • SHA1

    fcf2c9ee02913e67a86f08fad9c8d3d562eec0f8

  • SHA256

    f6c58c770610bb8396098c46b910df29536f795f2fe053f54e02bd213825b150

  • SHA512

    ab7b9feafcbee32d9959cd91b5b38ed7d187ab81eb9a156a6f7e2d9ff1e187317a89372ae72f07af0f161644fd3ee146c6f5b170a4153efebc75726bbcfd1595

  • SSDEEP

    1572864:QvhQ6lV7vDSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaSW2rnZmh2S:Qvh1HPSkB05awIxTy5nMHVLteS5e2S

Malware Config

Targets

    • Target

      BootstrapperV1.11.exe

    • Size

      75.5MB

    • MD5

      323317d95b40b3d5b1534611110ad12f

    • SHA1

      fcf2c9ee02913e67a86f08fad9c8d3d562eec0f8

    • SHA256

      f6c58c770610bb8396098c46b910df29536f795f2fe053f54e02bd213825b150

    • SHA512

      ab7b9feafcbee32d9959cd91b5b38ed7d187ab81eb9a156a6f7e2d9ff1e187317a89372ae72f07af0f161644fd3ee146c6f5b170a4153efebc75726bbcfd1595

    • SSDEEP

      1572864:QvhQ6lV7vDSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaSW2rnZmh2S:Qvh1HPSkB05awIxTy5nMHVLteS5e2S

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks