General
-
Target
Bootstrapper.rar
-
Size
105.3MB
-
Sample
240824-etasdavajj
-
MD5
4ec1b27b0737188de77fdeacaf888c13
-
SHA1
e9d020f59a4022db9c78e1c8992020d954f5d580
-
SHA256
0807281a3c3feac47f218d1aad39c44e1ed0c250861f8b9aa9874a76fec2147a
-
SHA512
a20fcc65bd60ac3d06148b96972fa0c868196c33a80ddda8faedfe891d25a3034e48cd60d064e928d9d81b9e20cd229df5e0f84669ab82f4d246053958a04531
-
SSDEEP
3145728:nf7i2+5A0Y4NZFp+8ft5sll6udViep1NqUytkmYn:nf7dsBlFp+nf6uOet/
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
Bootstrapper.exe
-
Size
106.9MB
-
MD5
6a07c32d6e77bd800cdf80b91368bebc
-
SHA1
43643d3aaa5ee4567a5b404de688d1389c7aa9a7
-
SHA256
76ac6ec42758b4e9f286e4dc79d04405fb90ea89343977546aa42059b1e228fa
-
SHA512
1f8440c226e93429cc8aec674c61928e9a9bd0976982dbc027919aa241785b5667ec24267243e06e96a012a810336f613141785c6b34fa63db4829f7a41cd402
-
SSDEEP
3145728:slvbiS6xjKcBa6R2qHO5izBVnG0iWMstB2OxpCK:Uv2SWNa6HHCittieB
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1