General

  • Target

    Bootstrapper.rar

  • Size

    105.3MB

  • Sample

    240824-etasdavajj

  • MD5

    4ec1b27b0737188de77fdeacaf888c13

  • SHA1

    e9d020f59a4022db9c78e1c8992020d954f5d580

  • SHA256

    0807281a3c3feac47f218d1aad39c44e1ed0c250861f8b9aa9874a76fec2147a

  • SHA512

    a20fcc65bd60ac3d06148b96972fa0c868196c33a80ddda8faedfe891d25a3034e48cd60d064e928d9d81b9e20cd229df5e0f84669ab82f4d246053958a04531

  • SSDEEP

    3145728:nf7i2+5A0Y4NZFp+8ft5sll6udViep1NqUytkmYn:nf7dsBlFp+nf6uOet/

Malware Config

Targets

    • Target

      Bootstrapper.exe

    • Size

      106.9MB

    • MD5

      6a07c32d6e77bd800cdf80b91368bebc

    • SHA1

      43643d3aaa5ee4567a5b404de688d1389c7aa9a7

    • SHA256

      76ac6ec42758b4e9f286e4dc79d04405fb90ea89343977546aa42059b1e228fa

    • SHA512

      1f8440c226e93429cc8aec674c61928e9a9bd0976982dbc027919aa241785b5667ec24267243e06e96a012a810336f613141785c6b34fa63db4829f7a41cd402

    • SSDEEP

      3145728:slvbiS6xjKcBa6R2qHO5izBVnG0iWMstB2OxpCK:Uv2SWNa6HHCittieB

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks