General
- Target 0e504beacd2873eaf1594a4f3f6f1fd51d7a136dac12476b6e4fe5d65f6eea0e
- Size 471KB
- Sample260801-xk2tlsfc66
- SHA256 0e504beacd2873eaf1594a4f3f6f1fd51d7a136dac12476b6e4fe5d65f6eea0e
Score
6/10
Malware Config
Targets
-
- Target Orderdrv/DrvType.exe
- Size 20KB
- SHA256 e10345e9f2fd3d49d024522fb7cb739a90fb8a11b29761a549c3e7e583fa22e1
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Orderdrv/fsutil.exe
- Size 87KB
- SHA256 b56c31f7c84d8eb0c35ed856b8d0b3ba074918d9822237466c1a149f77299a53
Score3/10 -
- Target Orderdrv/mountvol.exe
- Size 9KB
- SHA256 0c607c353799084f75da13477be884f9781ebd3e15a28d57e6bbdef0d6ab6bc6
Score3/10 -
- Target Orderdrv/orderdrv.cmd
- Size 25KB
- SHA256 6614953394597b7aa5965c98d7fdcc2c884de563877da7ca273ac05d489b5336
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Orderdrv/smartctl.exe
- Size 1008KB
- SHA256 91f3dbb6f33555e2965ea7cf806bb0ff7acbf07c3b9708acf9decc56b700666f
Score3/10