Overview

overview

8

Static

static

3

Setup.exe

windows7-x64

6

Setup.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    Setup.exe

  • Size

    252KB

  • Sample

    241013-c5xeeavfkf

  • MD5

    7df5e87056a4001b690c889cf194531b

  • SHA1

    d4506dd1fa781ac343f93a8710d38c86a3e863eb

  • SHA256

    bc599f97740d6221f36c64234c5b476cbca8ad2a0117f101e9ca9ae74bf41c47

  • SHA512

    6481579e5d8a413c58e1689e5bff55c3af2fbb69eade00b23026b6723178eb8421cac29fc939851a060e1bbb0d815c61281a4b9fb0acfb0ee8b354827e86fd6d

  • SSDEEP

    6144:DCMkFT/LVxBA0PLDjgvQZBVzdI/INiNYuz9AX37uk:DC/LnBA0PLD8vmBZdKy4suk

Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      252KB

    • MD5

      7df5e87056a4001b690c889cf194531b

    • SHA1

      d4506dd1fa781ac343f93a8710d38c86a3e863eb

    • SHA256

      bc599f97740d6221f36c64234c5b476cbca8ad2a0117f101e9ca9ae74bf41c47

    • SHA512

      6481579e5d8a413c58e1689e5bff55c3af2fbb69eade00b23026b6723178eb8421cac29fc939851a060e1bbb0d815c61281a4b9fb0acfb0ee8b354827e86fd6d

    • SSDEEP

      6144:DCMkFT/LVxBA0PLDjgvQZBVzdI/INiNYuz9AX37uk:DC/LnBA0PLD8vmBZdKy4suk

    Score
    8/10
    bootkitdiscoverypersistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks