Overview

overview

10

Static

static

1

914c965590...9e.exe

windows7-x64

10

914c965590...9e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    914c9655900b5fe48a51e6814c32a72dad0eb315b9422d22412c0349d918009e

  • Size

    9.8MB

  • Sample

    240820-g9818a1erp

  • MD5

    764647736f890ef13f918079dc9d72cf

  • SHA1

    1709f276759093323650d98d724124f9906adb05

  • SHA256

    914c9655900b5fe48a51e6814c32a72dad0eb315b9422d22412c0349d918009e

  • SHA512

    f766939786f1ee13a7e8fd04eaec0c4371f1ca100610c3bf224578cb25070aed7b93cd187bf6e4c89113de996bd97ee054714fa7f43bb2ff3cc281fb20293f97

  • SSDEEP

    196608:t9++KYyCBPgEdqiz0UKq3GaXcaK4PotqSOpsgymzgqae6WMr:kY9PgOlzLKq2GcP44ON2e6n

Score
10/10
shurkbootkitdiscoveryevasioninfostealerpersistenceransomwareupx

Malware Config

Targets

    • Target

      914c9655900b5fe48a51e6814c32a72dad0eb315b9422d22412c0349d918009e

    • Size

      9.8MB

    • MD5

      764647736f890ef13f918079dc9d72cf

    • SHA1

      1709f276759093323650d98d724124f9906adb05

    • SHA256

      914c9655900b5fe48a51e6814c32a72dad0eb315b9422d22412c0349d918009e

    • SHA512

      f766939786f1ee13a7e8fd04eaec0c4371f1ca100610c3bf224578cb25070aed7b93cd187bf6e4c89113de996bd97ee054714fa7f43bb2ff3cc281fb20293f97

    • SSDEEP

      196608:t9++KYyCBPgEdqiz0UKq3GaXcaK4PotqSOpsgymzgqae6WMr:kY9PgOlzLKq2GcP44ON2e6n

    Score
    10/10
    shurkbootkitdiscoveryevasioninfostealerpersistenceransomwareupx

    • Shurk

      Shurk is an infostealer, written in C++ which appeared in 2021.

      infostealershurk

    • Disables RegEdit via registry modification

      evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks