General
-
Target
Boostrapper.exe
-
Size
40.6MB
-
Sample
240824-q24k7svbrl
-
MD5
d777fc6149930afc4ba10323740d7a41
-
SHA1
f59e3454392c33247d8711df24038c4b2e6bc31f
-
SHA256
d0cbdcb8b64ac6fec53f1141b0dc2cb95a797973da88a9e5f5869e56ff00c98c
-
SHA512
44fc0f8bad392106504e749cb6b33fa716d58c9aa8364813c83b2137f777c698747ab2fefec14911f73a62c9681f3b32ef371374cfd2c2f3f0bc35dd9c34a972
-
SSDEEP
786432:ddBJEM9tbOO+k9H+7qmRb78RXkUkJvHKsxnaSgg20V9qy/pW6KV:dZEcYKe7PROXWJSsFaRyhHKV
Malware Config
Targets
-
-
Target
Boostrapper.exe
-
Size
40.6MB
-
MD5
d777fc6149930afc4ba10323740d7a41
-
SHA1
f59e3454392c33247d8711df24038c4b2e6bc31f
-
SHA256
d0cbdcb8b64ac6fec53f1141b0dc2cb95a797973da88a9e5f5869e56ff00c98c
-
SHA512
44fc0f8bad392106504e749cb6b33fa716d58c9aa8364813c83b2137f777c698747ab2fefec14911f73a62c9681f3b32ef371374cfd2c2f3f0bc35dd9c34a972
-
SSDEEP
786432:ddBJEM9tbOO+k9H+7qmRb78RXkUkJvHKsxnaSgg20V9qy/pW6KV:dZEcYKe7PROXWJSsFaRyhHKV
Score10/10-
Deletes Windows Defender Definitions
Uses mpcmdrun utility to delete all AV definitions.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-