General
-
Target
BoostrapperV1.24.exe
-
Size
7.6MB
-
Sample
241223-nk91jsyrbr
-
MD5
16e20af759391f4deb62ea9e91d5b6e3
-
SHA1
0169305e4b33d23952a6a2d3ff75c7de7e113ede
-
SHA256
07d582c015b2b7e188e1949e121f24bcfa1f328efc61753b8bd59e7e7355b5cf
-
SHA512
f2783b9ad25ff055e8a1a40aa6f5cc90bc3d34560fd32f89156069774a79bac498d93044da019c0528ad297b4612ba81dfaecb69001bd87c480107140c0c9965
-
SSDEEP
196608:PtD+kd7wfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWc:F5OIHL7HmBYXrYSaUNC
Behavioral task
behavioral1
Sample
BoostrapperV1.24.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
BoostrapperV1.24.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
��Gх�.pyc
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
��Gх�.pyc
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
BoostrapperV1.24.exe
-
Size
7.6MB
-
MD5
16e20af759391f4deb62ea9e91d5b6e3
-
SHA1
0169305e4b33d23952a6a2d3ff75c7de7e113ede
-
SHA256
07d582c015b2b7e188e1949e121f24bcfa1f328efc61753b8bd59e7e7355b5cf
-
SHA512
f2783b9ad25ff055e8a1a40aa6f5cc90bc3d34560fd32f89156069774a79bac498d93044da019c0528ad297b4612ba81dfaecb69001bd87c480107140c0c9965
-
SSDEEP
196608:PtD+kd7wfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWc:F5OIHL7HmBYXrYSaUNC
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
-
-
Target
��Gх�.pyc
-
Size
1KB
-
MD5
e78322a9ea9799f0d2f6e4ba1306aef3
-
SHA1
a3ea67ee1cc9c8ca9e6679636a08fc15d777e212
-
SHA256
860a0d01515395fcf08ed4f7e5f734411fc16b49eb082a692a90d4a4bccb4fae
-
SHA512
985c60222c5bdfa11bed93c62f1b7e5582a549f8b857d98f97beaa5a1b2951677e384bc7a9b348c60c5769149b7fb64bfb733aae83f3a9759ccb85ecda6e6869
Score1/10 -
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3