Overview

overview

8

Static

static

3

ca60890177...f1.exe

windows7-x64

8

ca60890177...f1.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca60890177f092087f37050cdce91a3ef1f932651bd200f76625c8a13ba2ebf1

  • Size

    446KB

  • Sample

    240829-dmxg5a1bpb

  • MD5

    0d47d733753cbcc7117f987d860d0232

  • SHA1

    72c7a1c30d33a32a849b43030f82e2743d1b0d76

  • SHA256

    ca60890177f092087f37050cdce91a3ef1f932651bd200f76625c8a13ba2ebf1

  • SHA512

    324c67156bdf3d1d1892075552b7a5c6519f3c714d4bc41f18c72b47b69ca4b17a74580005f772e9bc3c380ec1f3228e2150b6772eab16eb62c0cc41be9295e0

  • SSDEEP

    12288:sQ3wmKKS7E/iWaYBD5SwWZCLc39cHX3VLcR:sewho6WaYBekaaHBk

Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      ca60890177f092087f37050cdce91a3ef1f932651bd200f76625c8a13ba2ebf1

    • Size

      446KB

    • MD5

      0d47d733753cbcc7117f987d860d0232

    • SHA1

      72c7a1c30d33a32a849b43030f82e2743d1b0d76

    • SHA256

      ca60890177f092087f37050cdce91a3ef1f932651bd200f76625c8a13ba2ebf1

    • SHA512

      324c67156bdf3d1d1892075552b7a5c6519f3c714d4bc41f18c72b47b69ca4b17a74580005f772e9bc3c380ec1f3228e2150b6772eab16eb62c0cc41be9295e0

    • SSDEEP

      12288:sQ3wmKKS7E/iWaYBD5SwWZCLc39cHX3VLcR:sewho6WaYBekaaHBk

    Score
    8/10
    bootkitdiscoverypersistence

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks