ae5972022d090afe143295e2e278e37e40a80a774dc19b5c7ef140d081fabada

General

Target
boykisser.exe
Size 4.0MB
Sample260701-c24pbacy9l
SHA256 ae5972022d090afe143295e2e278e37e40a80a774dc19b5c7ef140d081fabada
MD5 f675e16da1ec67ca46eccb4339531465
SHA1 c0768f1dcaef667747a0ee35c5d276c276ff0298
SHA512 d0717f053284f55604885a3c04a3b7b4b29188ee39542868e47a99ab52242b8847665d82fb5be368b96f6ee52d05d82e048c11b707bed557b7b03911d5cf6cc1
SSDEEP 49152:N1t+XLczQKWt193KqzBJSWbC7SS2PA9d0JPxR1avSwglRbg79GnNc7k+sE/9x/qZ:B+bc8Zbm8PqEPxvyhWm9BsE/4P
TLSH
T13416332E8246865FC5932AF87F0F4C6A79D8D2129133D2A359762CBC731A158F3DC46E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  boykisser.exe
- Size 4.0MB
- SHA256 ae5972022d090afe143295e2e278e37e40a80a774dc19b5c7ef140d081fabada
- MD5 f675e16da1ec67ca46eccb4339531465
- SHA1 c0768f1dcaef667747a0ee35c5d276c276ff0298
- SHA512 d0717f053284f55604885a3c04a3b7b4b29188ee39542868e47a99ab52242b8847665d82fb5be368b96f6ee52d05d82e048c11b707bed557b7b03911d5cf6cc1
- SSDEEP 49152:N1t+XLczQKWt193KqzBJSWbC7SS2PA9d0JPxR1avSwglRbg79GnNc7k+sE/9x/qZ:B+bc8Zbm8PqEPxvyhWm9BsE/4P
- TLSH
  T13416332E8246865FC5932AF87F0F4C6A79D8D2129133D2A359762CBC731A158F3DC46E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution impact persistence ransomware trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1