Overview

overview

7

Static

static

5

anvirrus.exe

windows10-2004-x64

6

anvirrus.exe

windows11-ltsc_2024-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$TEMP/AnVir.exe

windows10-2004-x64

6

$TEMP/AnVir.exe

windows11-ltsc_2024-x64

6

AnVir.exe

windows10-2004-x64

6

AnVir.exe

windows11-ltsc_2024-x64

6

AnvirHook8.dll

windows10-2004-x64

3

AnvirHook8.dll

windows11-ltsc_2024-x64

3

AnvirHook8_64.dll

windows10-2004-x64

1

AnvirHook8_64.dll

windows11-ltsc_2024-x64

1

AnvirRunServ.exe

windows10-2004-x64

3

AnvirRunServ.exe

windows11-ltsc_2024-x64

3

OpenHardwa...ls.dll

windows10-2004-x64

1

OpenHardwa...ls.dll

windows11-ltsc_2024-x64

1

OpenHardwa...e.html

windows10-2004-x64

3

OpenHardwa...e.html

windows11-ltsc_2024-x64

3

OpenHardwa...or.exe

windows10-2004-x64

7

OpenHardwa...or.exe

windows11-ltsc_2024-x64

7

OpenHardwa...ib.dll

windows10-2004-x64

1

OpenHardwa...ib.dll

windows11-ltsc_2024-x64

1

OpenHardwa...ms.dll

windows10-2004-x64

1

OpenHardwa...ms.dll

windows11-ltsc_2024-x64

1

OpenHardwa...ot.dll

windows10-2004-x64

1

OpenHardwa...ot.dll

windows11-ltsc_2024-x64

1

VirusTotalUpload.exe

windows10-2004-x64

3

VirusTotalUpload.exe

windows11-ltsc_2024-x64

3

anvir64.exe

windows10-2004-x64

1

anvir64.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    anvirrus.exe
  • Size 4.2MB
  • Sample260721-nb82wsdy3k
  • SHA256 0bd3193b8d956fab39534d42c2c7768d7867085642e1128221265b69d0d1bcc7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoveryexecutionpersistencespywaretrojanupx

Malware Config

Targets

    • Target
      anvirrus.exe
    • Size 4.2MB
    • SHA256 0bd3193b8d956fab39534d42c2c7768d7867085642e1128221265b69d0d1bcc7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoveryexecutionpersistencespywaretrojan
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/INetC.dll
    • Size 24KB
    • SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $TEMP/AnVir.exe
    • Size 11.1MB
    • SHA256 ea0b5447389caee8493e6f0ccd6e68e6ac0bb9b5b78ba2d1b3b9ae4310ff65a1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdefense_evasiondiscoverypersistencespywaretrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral7behavioral8
    • Target
      AnVir.exe
    • Size 11.1MB
    • SHA256 ea0b5447389caee8493e6f0ccd6e68e6ac0bb9b5b78ba2d1b3b9ae4310ff65a1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdefense_evasiondiscoverypersistencespywaretrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral10behavioral9
    • Target
      AnvirHook8.dll
    • Size 110KB
    • SHA256 a6c075b925098f4001ec38875e92a39c47c4bc3d41e14df207bff1690839b15a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      AnvirHook8_64.dll
    • Size 123KB
    • SHA256 0347048170d988abcb8644913dbb0933f73271e4183e283acdf8b3a05acf6b57
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      AnvirRunServ.exe
    • Size 68KB
    • SHA256 f3f9dee6e24f55405b63fe15016419439645f22104d68f9250d22d57311dd087
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      OpenHardwareMonitor/Aga.Controls.dll
    • Size 142KB
    • SHA256 830e520caf3e89dccaa3c12e3bfc992221c164f2319a2ba57e402499c24290e3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      OpenHardwareMonitor/License.html
    • Size 27KB
    • SHA256 b14e66270c828c445662328127f68042a1d6b17e7382e150e542a2045b1a9075
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      OpenHardwareMonitor/OpenHardwareMonitor.exe
    • Size 482KB
    • SHA256 ec767a74c5659a05bdb7ac10bd42c2ea6d44fa946286029b2866aed476ad83bc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    bootkitpersistence

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral21behavioral22
    • Target
      OpenHardwareMonitor/OpenHardwareMonitorLib.dll
    • Size 304KB
    • SHA256 ef02b0991aac678052bb79dfdfd5bfa0b42b1f34b209e35819ba606909655f58
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      OpenHardwareMonitor/OxyPlot.WindowsForms.dll
    • Size 21KB
    • SHA256 c92cfe4026ef2319c84aab392f274ebdeb135db85123ff0e44edf4a99b05c7d0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      OpenHardwareMonitor/OxyPlot.dll
    • Size 298KB
    • SHA256 d3a00f3b9fbf82c4ee9fcf495a0fcc80f9f26711b4bb4fe15e0b769d47488b50
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      VirusTotalUpload.exe
    • Size 157KB
    • SHA256 9f0e6c3c398f16adce5af7b72fa51b820c1475336761c504a518aab9255762d1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      anvir64.exe
    • Size 214KB
    • SHA256 6e8d0df6c01549a9516d33c38b57949e58f4bb873a38dfcfc58b85eea533fae6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

upx
Score
5/10

behavioral1

defense_evasiondiscoveryexecutionpersistencespywaretrojan
Score
6/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

bootkitdefense_evasiondiscoverypersistencespywaretrojan
Score
6/10

behavioral8

bootkitdefense_evasiondiscoverypersistencespywaretrojan
Score
6/10

behavioral9

bootkitdefense_evasiondiscoverypersistencespywaretrojan
Score
6/10

behavioral10

bootkitdefense_evasiondiscoverypersistencespywaretrojan
Score
6/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

bootkitpersistence
Score
7/10

behavioral22

bootkitpersistence
Score
7/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

Score
1/10

behavioral32

Score
1/10