Overview

overview

10

Static

static

5

Bootsrapper.exe

windows11-21h2-x64

10

mpclient.dll

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Archive.zip
  • Size 2.0MB
  • Sample260629-19cskagw21
  • SHA256 8b5ea4c557ed8fda3b0aa20b16404c873d28a170f35d1249e77eb27e2d66ef04
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryspywarestealer

Malware Config

Targets

    • Target
      Bootsrapper.exe
    • Size 683KB
    • SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryspywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1
    • Target
      mpclient.dll
    • Size 3.7MB
    • SHA256 3d2a4d70f026db59f90f4c72e719fae9072cd23a552530f8211cf18f114530cd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral2

MITRE ATT&CK Enterprise v16

Tasks