General
-
Target
Bootstrapper.exe
-
Size
796KB
-
Sample
241013-hsg2vaycqp
-
MD5
4b94b989b0fe7bec6311153b309dfe81
-
SHA1
bb50a4bb8a66f0105c5b74f32cd114c672010b22
-
SHA256
7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659
-
SHA512
fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d
-
SSDEEP
12288:jHeLH6iTPSE54sgweI9oaQaj3T+piq+77xOZ+eMm:jHeLHdTSEeyoaQaj3apiq+77xd
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
Bootstrapper.exe
-
Size
796KB
-
MD5
4b94b989b0fe7bec6311153b309dfe81
-
SHA1
bb50a4bb8a66f0105c5b74f32cd114c672010b22
-
SHA256
7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659
-
SHA512
fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d
-
SSDEEP
12288:jHeLH6iTPSE54sgweI9oaQaj3T+piq+77xOZ+eMm:jHeLHdTSEeyoaQaj3apiq+77xd
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Blocklisted process makes network request
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-