f83bc86dfdb72d249890018808cdf02e08960b8cc34692fd801260019caeaf78

Sharing

Copy URL Twitter E-mail

General

Target
Velo.cc Kernel Spoofer V3.rar
Size 27.2MB
Sample260710-3zycmaat81
SHA256 f83bc86dfdb72d249890018808cdf02e08960b8cc34692fd801260019caeaf78
MD5 899508082d0df98d0902b7ca26faead1
SHA1 4a5da60f8ea6a083251c8522eed1e68c1d6dfbc5
SHA512 7207b6d4d1ca76766f1f60266e8017b98e2f9a38d18e08283656bcf323d6c55b368f4e5d20554f07ec93c4373b533696d7e309ea1db55bd49eed1058b228b2a6
SSDEEP 786432:9DH8o+xQqkJzOHNAdAsYSgaIGOOfcx01Z1YJ:9D9DqQiNwAs9RIqci1HYJ
TLSH
T13B57338EE6A53F319294DC9B341CF9CA6A8B5D2093573ABE471FD08F05C0E5C8699C36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Velo.cc Kernel Spoofer V3.rar
- Size 27.2MB
- SHA256 f83bc86dfdb72d249890018808cdf02e08960b8cc34692fd801260019caeaf78
- MD5 899508082d0df98d0902b7ca26faead1
- SHA1 4a5da60f8ea6a083251c8522eed1e68c1d6dfbc5
- SHA512 7207b6d4d1ca76766f1f60266e8017b98e2f9a38d18e08283656bcf323d6c55b368f4e5d20554f07ec93c4373b533696d7e309ea1db55bd49eed1058b228b2a6
- SSDEEP 786432:9DH8o+xQqkJzOHNAdAsYSgaIGOOfcx01Z1YJ:9D9DqQiNwAs9RIqci1HYJ
- TLSH
  T13B57338EE6A53F319294DC9B341CF9CA6A8B5D2093573ABE471FD08F05C0E5C8699C36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Unbranded/Checker/Checker.exe
- Size 135KB
- SHA256 30da59229b5287379482be56c9c19ab34577eec721c456be808f0f8b88ce4d3d
- MD5 7f19b747d95908b36ee9ef8d93acdb4b
- SHA1 7d0c1259f30f5e14b8a910538a89a65e88d06546
- SHA512 2e37163c31e16c9af393c9ddabd0aa91afc98c1c6bb22bac820b683eb1f78d54173e04db38779fc485e7ca55be54705f0b902220f2b1a2c29a4c6d5d55d7002f
- SSDEEP 3072:LdntexJZP0LZMME1hiXg4DmmV9n2hHyHQvBfXEslm4kl0/YzVo:hntexJZ91hiXgommzGvpfEDsWo
- TLSH
  T104D31B36E96810BDD16AD6B5DE665C02F731788703716FDF07500AB20E26AE89F3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral3 behavioral4
- Target
  Unbranded/Checker/Example new.txt
- Size 11KB
- SHA256 0ddf807cecdd917e9b9a94ea28f7d89d95c3f4a4111c3ad38b45de5d568c18f4
- MD5 536c5527e5acefdc404341dd7016b6f4
- SHA1 27904a43880df8c0dd3b481cffeb3acb3bf99db4
- SHA512 13ff599c9ea4d9ee26e172c302bc6f75a33b3bc0790b4fc667147ac2eb47aae7ba697b448103cec85684471fe3dd912ace73e58c68596a8071fac06df46af971
- SSDEEP 192:Z0qmxRhgfsO/EfQC0U0Mc0GzFtNfw0f0n5B5Bi2iCmdm/NBAWYNAKL0hEwow6BwC:ZnmxRhgEKEfQlXeUsnzzNBhPbXc52e
- TLSH
  T1D93272291E2B91007077CB26E435A926FAF7A5A797D861DC766E49082FB3704038D78F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Unbranded/Checker/Example old.txt
- Size 11KB
- SHA256 bb52aa5d6dfe5b2f9d4526be5095c53bbeebde64a117e2a859aefcd2b7453414
- MD5 b642cfa30ebc4f7837d965f411120d73
- SHA1 0041280955a594eb3cc6ae7821e58b73b99d9572
- SHA512 d80afdcee89dc5ce7969a8947dd5441631cf6166543f79c16167c331fadf1194bc69657a01600624ddeec9febaf02b69fde8b263de5e03c28441d82a99288f85
- SSDEEP 192:Z0qmXRT2Ft+G2wHCUMWG3zfsVfn5N5NisiIm3mhoNCPlYVh12N2Hk6peI2S6:ZnmXRT2PX2wHb//bOZpeI2z
- TLSH
  T1B43233262E6B9504B03BCA1A98257D63F5B274B7EBD8618C7A6D45086FB370413CCB4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Unbranded/Debug/Debug.exe
- Size 3.8MB
- SHA256 0cf2dd30e8446a7adea07315848a4e43b60e1d72ba45592469411d1f96ac21eb
- MD5 4f89c2c4c1c5b4b188bb1f676b235deb
- SHA1 a9bbe3c34cae6a40904747d5e3e863f5b09df7c5
- SHA512 7939c4a414797b2a5b66c5e73864a6d2c523a98e71dd4ed5187e8521f42e26489e7f5839402e33358f49e4647a1c0efa189e04b39691a61bc10946ac035c8f71
- SSDEEP 98304:nBqjfnolnc7PyFUIxWm6DLmdiWMg39zjeX/w:nBqTolcDXIh6DLmdiWD31qX/w
- TLSH
  T1580623956DCE1675D1EBC77096437E2E703B33B18A417D0FBACDAC501D221EA243AB89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  Unbranded/Loader/185B1A400B4.exe
- Size 23.7MB
- SHA256 3662c1a2b3cd8a0e07706d03474d614dbeb58d9934cb392e9da2c680cec0045f
- MD5 5b2b277c664c0f32383db80224c0d61d
- SHA1 4c3868210a69def94f6c7c081af9cd007a8a54b6
- SHA512 d23c7218994da220cfe68b38872d1566daa327e2a4b45a5aec8d01db48e938e3ea344d78d69a4877b3f05edd04f9e0bee6fb0a5b4740033d18200c37b817b5e4
- SSDEEP 393216:diEGyw06dhyfXOzUgNd6rVA6bW4wj7uNt0s7f39n5I8v3bm1gj63JViiey34on78:gRyCdkXOYw6rxWJKZV5I6m14QJVreq4p
- TLSH
  T12E4733C67A86C925D0E3C3FB4912117EB70D7B794BA18C48B4487F66DE921513F3AAC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Writes to the Master Boot Record (MBR)

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12