General
- Target salinewin1.5.zip
- Size 202KB
- Sample260727-qy1edabc54
- SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
Score
8/10
Malware Config
Targets
-
- Target salinewin1.5-safety.exe
- Size 245KB
- SHA256 bafd3d712a32b884001dccd7f6f77fd9aa515b254352310e20f67026364c7884
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target salinewin1.5.exe
- Size 279KB
- SHA256 fbdaec9e16cb120887975def752432ff798834d521cfc87b24923bf6d3acfe4a
Score8/10-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.