Overview

overview

8

Static

static

1

Growth.jpg

windows10-ltsc 2021-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Growth.jpg

  • Size

    151KB

  • Sample

    250218-kdj9rsypf1

  • MD5

    61adfdb1f8c98953b2dedc565c868ea1

  • SHA1

    4ce6ab3b75226d43fa96f190f4eb8fd04ccb74a4

  • SHA256

    dae91aff9e767207e859d0f3c36b5bf1e3b99ef0a8bef8ac0c7af29cdac90fe1

  • SHA512

    e8090e479722c0e58ee0809bcd293e585ddfdf9a7235bd5b48baa49adf6b4f53f9955a9000c49dfca0043f016efb7be31758aa23f390349db72efb9db461a9f5

  • SSDEEP

    3072:mQlUAZwgXe93n/0sFxA9fq06CtVkT+oCrfnS3wrB9W7TzFgXM7:VlUACH5/0DJl+sS0WjaM7

Score
8/10
bootkitdefense_evasiondiscoverypersistence

Malware Config

Targets

    • Target

      Growth.jpg

    • Size

      151KB

    • MD5

      61adfdb1f8c98953b2dedc565c868ea1

    • SHA1

      4ce6ab3b75226d43fa96f190f4eb8fd04ccb74a4

    • SHA256

      dae91aff9e767207e859d0f3c36b5bf1e3b99ef0a8bef8ac0c7af29cdac90fe1

    • SHA512

      e8090e479722c0e58ee0809bcd293e585ddfdf9a7235bd5b48baa49adf6b4f53f9955a9000c49dfca0043f016efb7be31758aa23f390349db72efb9db461a9f5

    • SSDEEP

      3072:mQlUAZwgXe93n/0sFxA9fq06CtVkT+oCrfnS3wrB9W7TzFgXM7:VlUACH5/0DJl+sS0WjaM7

    Score
    8/10
    bootkitdefense_evasiondiscoverypersistence

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks