5a7524f15aaf9ed70dc4fd842e951471c0b99852fe71bd5aa4302bffdc56b889 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5a7524f15aaf9ed70dc4fd842e951471c0b99852fe71bd5aa4302bffdc56b889N
Size

2.2MB
Sample

241009-phpghayekd
MD5

400993627dd934f64df7a510b15adb90
SHA1

f97fcb1e3a3962904720690380b744a721e38571
SHA256

5a7524f15aaf9ed70dc4fd842e951471c0b99852fe71bd5aa4302bffdc56b889
SHA512

4bb53a48442795a5fdedb56a772e9f82c50b850a128a3630d3ee84c94e54f12b806a98c987cfb7c74a4a1c3bf529a3136a8dacfb4e8b453fb370861377364a57
SSDEEP

49152:YuSn1hfOtb0u+1Gtmtjg/3JhFzRFuWHC6pd:W1hf9tpjA3JHNhHCkd

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  5a7524f15aaf9ed70dc4fd842e951471c0b99852fe71bd5aa4302bffdc56b889N
- Size
  
  2.2MB
- MD5
  
  400993627dd934f64df7a510b15adb90
- SHA1
  
  f97fcb1e3a3962904720690380b744a721e38571
- SHA256
  
  5a7524f15aaf9ed70dc4fd842e951471c0b99852fe71bd5aa4302bffdc56b889
- SHA512
  
  4bb53a48442795a5fdedb56a772e9f82c50b850a128a3630d3ee84c94e54f12b806a98c987cfb7c74a4a1c3bf529a3136a8dacfb4e8b453fb370861377364a57
- SSDEEP
  
  49152:YuSn1hfOtb0u+1Gtmtjg/3JhFzRFuWHC6pd:W1hf9tpjA3JHNhHCkd
Score

7^/10

bootkit discovery persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

bootkitdiscoverypersistence