61c8d219d29296ed0d06afdcb43f450485886cf7b24879ddec72b04d977859b6 | Triage

Submit
Reports

Overview

overview

Static

static

3

61c8d219d2...6N.exe

windows7-x64

61c8d219d2...6N.exe

windows10-2004-x64

Sharing

General

Target

61c8d219d29296ed0d06afdcb43f450485886cf7b24879ddec72b04d977859b6N
Size

708KB
Sample

241005-nw5vzasdmr
MD5

08e9e6a30e19dabdb1d0e7a4ec72d2f0
SHA1

41fa3bc692426853e0264456016059dd9bb60f89
SHA256

61c8d219d29296ed0d06afdcb43f450485886cf7b24879ddec72b04d977859b6
SHA512

056a755a166b7a74f08ae81bfcc219ddabceb9645c8e70788b443f3f5ad820ca333748eb55e347cf5f5a6ab0e43da45dab423690b0af1f9b5a9858bbe2bfd2e3
SSDEEP

12288:v6kFXF2u9rSgXPDV4JSrX0rLVRZt0kJrZKxFvaoWSSbg1OS:ykFVx54JGX0rLVLt0Lx9WSV1h

Score

10^/10

bootkit discovery evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

61c8d219d29296ed0d06afdcb43f450485886cf7b24879ddec72b04d977859b6N.exe

Resource

win7-20240903-en

bootkit discovery evasion persistence upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

61c8d219d29296ed0d06afdcb43f450485886cf7b24879ddec72b04d977859b6N.exe

Resource

win10v2004-20240910-en

bootkit discovery evasion persistence upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  61c8d219d29296ed0d06afdcb43f450485886cf7b24879ddec72b04d977859b6N
- Size
  
  708KB
- MD5
  
  08e9e6a30e19dabdb1d0e7a4ec72d2f0
- SHA1
  
  41fa3bc692426853e0264456016059dd9bb60f89
- SHA256
  
  61c8d219d29296ed0d06afdcb43f450485886cf7b24879ddec72b04d977859b6
- SHA512
  
  056a755a166b7a74f08ae81bfcc219ddabceb9645c8e70788b443f3f5ad820ca333748eb55e347cf5f5a6ab0e43da45dab423690b0af1f9b5a9858bbe2bfd2e3
- SSDEEP
  
  12288:v6kFXF2u9rSgXPDV4JSrX0rLVRZt0kJrZKxFvaoWSSbg1OS:ykFVx54JGX0rLVLt0Lx9WSV1h
Score

10^/10

bootkit discovery evasion persistence upx
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoveryevasionpersistenceupx

behavioral2

bootkitdiscoveryevasionpersistenceupx

© 2018-2025

Terms | Privacy