Overview

overview

9

Static

static

3

fac29c6279...4c.exe

windows7-x64

9

fac29c6279...4c.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fac29c6279b2c455e0bbb7e6807bba4c.exe

  • Size

    3.7MB

  • Sample

    241121-qjrhxsshpm

  • MD5

    fac29c6279b2c455e0bbb7e6807bba4c

  • SHA1

    c695b56d1bc578c5a9be17576dc0dc751f96ddf5

  • SHA256

    2f5eca6db1b9c15b9649a8ef98d227553c5dc5307f89af755eb8bad56c834f6f

  • SHA512

    77682035c811bc60a623d841ffa04309b3e9dd37e1c07d3f75c1e52e427b60d367f695f6548dd2892f1900aa5615c092b5605959261e5f58d16004ae68679f8b

  • SSDEEP

    98304:MtlBG7mMio8fdJY4UQNkvBTwachhOrOf7RhBOAz7sbWPmiKJdDiL:MtW7Hio0JY4qZfpOh7syPmiKJA

Score
9/10
bootkitdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      fac29c6279b2c455e0bbb7e6807bba4c.exe

    • Size

      3.7MB

    • MD5

      fac29c6279b2c455e0bbb7e6807bba4c

    • SHA1

      c695b56d1bc578c5a9be17576dc0dc751f96ddf5

    • SHA256

      2f5eca6db1b9c15b9649a8ef98d227553c5dc5307f89af755eb8bad56c834f6f

    • SHA512

      77682035c811bc60a623d841ffa04309b3e9dd37e1c07d3f75c1e52e427b60d367f695f6548dd2892f1900aa5615c092b5605959261e5f58d16004ae68679f8b

    • SSDEEP

      98304:MtlBG7mMio8fdJY4UQNkvBTwachhOrOf7RhBOAz7sbWPmiKJdDiL:MtW7Hio0JY4qZfpOh7syPmiKJA

    Score
    9/10
    bootkitdiscoveryevasionpersistencetrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks