General
- Target fe199fff0205f26062eca483a1a59f6ceb4c9416d25782dd7e3cd1f87fc127bd
- Size 607KB
- Sample260802-j4v9aawsgz
- SHA256 fe199fff0205f26062eca483a1a59f6ceb4c9416d25782dd7e3cd1f87fc127bd
Score
7/10
Malware Config
Targets
-
- Target WinosInfo.exe
- Size 548KB
- SHA256 5550f99db16e47d401bef5ea0452ec94417eb2f0e9d0521c19ba2b723ca8525b
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target WinosInfo_x86.exe
- Size 505KB
- SHA256 96c9f20b4dd86b546562b32d591f9f32b6c9f30f178ce77b86c47a6ca31af981
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target 去脚本之家看看.url
- Size 124B
- SHA256 c4965fa0cf71f391518797b3cc3b7ffef0ec991c5266f5f9cc90298a7da7e1da
Score1/10 -
- Target 服务器软件.url
- Size 112B
- SHA256 c85359e7af5e102716e42f659fd5c1931b553761898714ccbb261883a03f40e1
Score1/10