a9614c6564109168c11a853f00a2073803c8a26af2effa33b861d80f78121e54 | Triage

Resubmissions

16-12-2024 20:02

241216-yskezaznap 10

16-12-2024 20:00

241216-yrb27szmhl 9

16-12-2024 19:57

241216-yparcszmek 8

16-12-2024 19:52

241216-ylqneaypds 8

16-12-2024 19:49

241216-yjtbhsynhx 10

Sharing

General

Target

sample
Size

258KB
Sample

241216-yjtbhsynhx
MD5

37698ffffe211da5c8b3f97ec1f36bae
SHA1

83f5b50f58b8c0a1451e8ba9f119b526abae76df
SHA256

a9614c6564109168c11a853f00a2073803c8a26af2effa33b861d80f78121e54
SHA512

368e0ee6d90d1f1746c23a520520a658964a7d289f846f2ed94772f28bb7331af763dc99fc7a8395c4a19314b35fbe9c5aa9e765cf7092e59cbd8f48f8ee3134
SSDEEP

6144:giaRHpOL/saqkPV9FemLtcIDSsmwj9OvZJT3CqbMrhryf65NRPaCieMjAkvCJv1/:laRHpOL/saqkPV9FemLtcIDSsmwj9OvY

Score

10^/10

agilenet bootkit defense_evasion discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  sample
- Size
  
  258KB
- MD5
  
  37698ffffe211da5c8b3f97ec1f36bae
- SHA1
  
  83f5b50f58b8c0a1451e8ba9f119b526abae76df
- SHA256
  
  a9614c6564109168c11a853f00a2073803c8a26af2effa33b861d80f78121e54
- SHA512
  
  368e0ee6d90d1f1746c23a520520a658964a7d289f846f2ed94772f28bb7331af763dc99fc7a8395c4a19314b35fbe9c5aa9e765cf7092e59cbd8f48f8ee3134
- SSDEEP
  
  6144:giaRHpOL/saqkPV9FemLtcIDSsmwj9OvZJT3CqbMrhryf65NRPaCieMjAkvCJv1/:laRHpOL/saqkPV9FemLtcIDSsmwj9OvY
Score

10^/10

agilenet bootkit defense_evasion discovery evasion persistence trojan
- UAC bypass
  evasion trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

SIP and Trust Provider Hijacking

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

agilenetbootkitdefense_evasiondiscoveryevasionpersistencetrojan