Overview

overview

9

Static

static

3

7b0ac8fec2...77.exe

windows7-x64

9

7b0ac8fec2...77.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    7b0ac8fec2e04bfbb8c42cb0944bf89de8c336d3916cd4e86f0f98f1a4659c77

  • Size

    3.5MB

  • Sample

    240903-1f7qvaxfpn

  • MD5

    e9f15d6976cc2201bfba5d4781ce1a69

  • SHA1

    519e3aeda6b0952cecf9d333f7e08cee7aa8c2f0

  • SHA256

    7b0ac8fec2e04bfbb8c42cb0944bf89de8c336d3916cd4e86f0f98f1a4659c77

  • SHA512

    5c41f4c90a4c2dea8eb38a91c563b1202d3b8988c3fe913dee5da6def7eae21a14f86ea19986cf25832ef25dce222707cccad6914af785946a2b010df93ab3f8

  • SSDEEP

    98304:R50hdB4b2ljDFfMEV5cZHd2bOoup86unPBE:v0hDljDFME2uOC

Score
9/10
bootkitdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      7b0ac8fec2e04bfbb8c42cb0944bf89de8c336d3916cd4e86f0f98f1a4659c77

    • Size

      3.5MB

    • MD5

      e9f15d6976cc2201bfba5d4781ce1a69

    • SHA1

      519e3aeda6b0952cecf9d333f7e08cee7aa8c2f0

    • SHA256

      7b0ac8fec2e04bfbb8c42cb0944bf89de8c336d3916cd4e86f0f98f1a4659c77

    • SHA512

      5c41f4c90a4c2dea8eb38a91c563b1202d3b8988c3fe913dee5da6def7eae21a14f86ea19986cf25832ef25dce222707cccad6914af785946a2b010df93ab3f8

    • SSDEEP

      98304:R50hdB4b2ljDFfMEV5cZHd2bOoup86unPBE:v0hDljDFME2uOC

    Score
    9/10
    bootkitdiscoveryevasionpersistencetrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks