Overview

overview

10

Static

static

10

Boostrapper.exe

windows10-ltsc 2021-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Boostrapper.exe

  • Size

    103.0MB

  • Sample

    250107-hy7jpazmev

  • MD5

    6f33bedd125bc6ad6e88248129e0fc11

  • SHA1

    b3586fc9d03717307d92527f71ecdf706a96de05

  • SHA256

    10bcf998d8b57e71eafc5d946eedf7a359c8a7fead89efc3ffc54d491d7d7728

  • SHA512

    263b690ae2101724fa63e38fccb801d42fe167866618419a42e47fc5e60d8ee656b58e59bd8299142fea3efac09361baf91ac119fca28f91aeb8207fd0e8679c

  • SSDEEP

    3145728:33nzTCRrS6xjKcBanL2qHO5iVXfnGQbRe0zJcB3Z2:HzOZSWNaBHCid1XcBE

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      Boostrapper.exe

    • Size

      103.0MB

    • MD5

      6f33bedd125bc6ad6e88248129e0fc11

    • SHA1

      b3586fc9d03717307d92527f71ecdf706a96de05

    • SHA256

      10bcf998d8b57e71eafc5d946eedf7a359c8a7fead89efc3ffc54d491d7d7728

    • SHA512

      263b690ae2101724fa63e38fccb801d42fe167866618419a42e47fc5e60d8ee656b58e59bd8299142fea3efac09361baf91ac119fca28f91aeb8207fd0e8679c

    • SSDEEP

      3145728:33nzTCRrS6xjKcBanL2qHO5iVXfnGQbRe0zJcB3Z2:HzOZSWNaBHCid1XcBE

    Score
    9/10
    evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks