bd5d02cd999619ffecf0154b8bd836413757b6182b72e9cbfe06e7c4102b95f2

Sharing

Copy URL Twitter E-mail

General

Target
bd5d02cd999619ffecf0154b8bd836413757b6182b72e9cbfe06e7c4102b95f2
Size 6.1MB
Sample260802-pbwl8sal4w
SHA256 bd5d02cd999619ffecf0154b8bd836413757b6182b72e9cbfe06e7c4102b95f2
MD5 b490878f934b0418108c005177a77f0e
SHA1 cfd12729eaafc974638130456e18570525324c93
SHA512 ffc543a646e611684b870edca57cef3c461716695115bce22c9a76b240f7f2f98492dc530a9e4ffa7fb798a2ea77415e1f3c4b44dcc16d7c2b28bbcd795a3f66
SSDEEP 196608:G3UdfK5PLmEo9z+bDa3ISUmELsOpIqeNQM/MAk:G3SfkPDGzKa3ISwnKqeNol
TLSH
T1905633DC9A68CABE487FE074952CAA27CDA700F70E734B7BD552261C4CD363F9161A84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  BatteryInfoView/BatteryInfoView.chm
- Size 81KB
- SHA256 1f2a9b3f36f3801b745f3b58e574c85c139939e49f26c06b71d5ebbc8a38b9d1
- MD5 484a5b0d1b74617fcc62433102077b22
- SHA1 c7ad378893b36d7e83c23db8f2d67c507069cc40
- SHA512 1277dc702e7ff1303811694412fd6573534a6adbf921b8f689abd2fb6fb87cafe5fd92bdb03a5f4bab4231ea2a4ac4f79dd09822f74a97582395609ae0b1c7b8
- SSDEEP 1536:FYRYICxclEqkSuH9eps0zVN1ClGYeQQnGXlr7ncSYvjDayX:6CICeEqk9nHndoSY7TX
- TLSH
  T1C9830257B1F01665D19C4DBA5BC06EC274A838C7414C8F0BAD72DA39AD827612FB7CA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  BatteryInfoView/BatteryInfoView.exe
- Size 112KB
- SHA256 d968b3ca81be45359e4dd70b66aa44e259bda3f50ecb27abcf537aa5a07c345a
- MD5 b122e1e6c21e657f616087d9b38c004d
- SHA1 dcc9f254ae7e197e02e829086bc0c78b6f0ae704
- SHA512 e0c99dbe006cb3a4e97bc12d67d7bd33424eb43797fc923ed15acd94a9c32d6227888d9e35abd399e4dddc0ab3b26b9f0c041bc656774322056558b65b6e13d3
- SSDEEP 3072:r3m1PL3t8xLxw+HOMxMq5DmwXN2n4k7NgribZINtotNwSz7kxNC:1NMqQnL
- TLSH
  T1C0B3290663F801DCE8AB95B6C9724623DBF1BC645834871F0BB4B99A1F37311AE16727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  CGI-plus_x64.exe
- Size 1.4MB
- SHA256 72e56c5aa2da498556938c0c10e9ba3f978b1eac7f67edd50ee2bf14a74ba89b
- MD5 0e86fd52a2b1dc2f5e0aeb27b1bc0a4d
- SHA1 64b92fe9985f49fdc58add696ca263fa63f14964
- SHA512 104d3c11e9a536060b5170e8b938b5cad51ddb58a194905d777013866e263c3c9a47ae877247ab94ff63f461d38380789a1a923e9a07e3e6a89531d756b9da1a
- SSDEEP 24576:DbtYXR7pTm3xA2fUZ3XRmeyRoBchfoOz7SdIIC30vCRgZxvzM:3uXR7KxVcpRFUoaHSdzC305ZdzM
- TLSH
  T12D6533141EDBB9A3C479E9F2A4B4D9629F9BCC539A7301DCD04B7D0944F393A78C4A48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit execution persistence
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies boot configuration data using bcdedit
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral5 behavioral6
- Target
  EasyGhost.exe
- Size 416KB
- SHA256 631a63321bc3570ea361bbaa84013b68bc07234e0cc8e921c1b158e0e84f983c
- MD5 28b59334039cc8acfdf8266d2f785512
- SHA1 e2a0cfa46b61269e8c82e91a3c3ee043b5f901a4
- SHA512 ffe95b42202e36285b0ff4ac2a79a934377734f04c9b5cf87d761c80b36a3aa11c7c378e65990d47c6bb2402a86cf4d6a9a2abfe07850b9a3f82c3446f303e83
- SSDEEP 12288:Yxg8RXljN2AoJTh1KmEn9YMAHxLul99DSOU1H7Y:Yraph1K39YDHxCp
- TLSH
  T1CA945A10BB80D072C26221724E53E37966B9AA319F2457C77BE43F3D6E702D1A93931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Ghost64.exe
- Size 7.1MB
- SHA256 9392631c5747eb8fd674e4275e90e71ac6ee70a31ba2fbc6d091c79a56c10738
- MD5 2421bc444278620d568c9b7ff50d6bb4
- SHA1 32070e0d9fee964913803c63daedf977e1b5a256
- SHA512 763f28d9703069aa7934d168ef84f0327e6b8115a39f550c945d2315c98bef9f07f2488fc859a35810a4a0b8ac9eccca1b2ca99a84754ac639639a614736a5d4
- SSDEEP 49152:lNtzEIbpcBR1qGzNQzJuKHb1/aiBQwtfhXhZ4gRTO9lI2szo4ENwS6QIsHZHdsus:dyRW1yiBQwtVVYssJrb6UWBjQK
- TLSH
  T1C3763C1AFB348175D067C67F9683DB86EAB274864B704BC705569B5A2F333E08A39331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral10 behavioral9
- Target
  Ghostexp.exe
- Size 2.8MB
- SHA256 fcac7f077610e4ad187c56fac17b297341a120cb95234c5d42c0db7f4d4f7cfe
- MD5 ef00653f51f1460f339352ec20d96a3c
- SHA1 826582d5e5a7e6f3f3e5c65f1d031737a91bdeb1
- SHA512 12e23d7232b27e463f24fd4cb984f84e32488b0a00bac8473900b98adbc685607c35d06d5dd62d3cf4ea8b479c3dc516a383e13f8d05929f2d46d622b079c7a2
- SSDEEP 49152:zxhaHNkYONmqGHljVgg363IOyHWKSKozOrc2skG/TGe3l:zbaHwQHjgy65y2XKtu
- TLSH
  T140D57D22BBD3C076CA6B023248E9D71D53F6D5605B318AC365D42A2E6F306D2BE3F591
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  GoHash.exe
- Size 124KB
- SHA256 2f694952db8809a553834fab49ff740371f6a3dec7967f296e1dabb693ea9af3
- MD5 441270eb47ef95f3f1206d29a0ba9035
- SHA1 5720f30f2e9f27e272b88361c63ca592e6b3386a
- SHA512 89f2fac1dffc9c0cffbcc7f62dd695262bf060ce5fdae86d752bf5143202082e3d60fed945727334c291445bbdfbe500c9206d7fe599d378df58650d65baf840
- SSDEEP 3072:LQ4tQOFu1H16YgIdFy5qT4hkNTqIRjMZ5qUFQX:bF6Y0DnT4hkNTbd
- TLSH
  T140C37D1573A001F8C06AD3B599F21E66E3B0B8550334676F872486A66F13BE1DE3E363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  wimlib64/libwim-15.dll
- Size 486KB
- SHA256 ba853ee1e3fc5f5798581f02e8e066ba07a0a2375f0bf444fe981431fd508495
- MD5 db1ef5ed32577db5433ce471ffb4b531
- SHA1 32baffa86cd54fe25d09ba937ee71094b55af7c8
- SHA512 99115190b1ed4cd32986ad1cb8778573b33d6b0d092d90a4ebd070ec0d123f4105bf66c07a389e2a0fcee1816f0fac1250c5f36030c9e3865c5f29b53482df13
- SSDEEP 6144:zC3LLufFLXCHlKyTgOSFuhLTmpkOLNw73ErtrZtkJGM2XbBz:zC3LafFLXdyUO9LT9gW7ErFZMGMa
- TLSH
  T103B43B02E3F311BCF2B7D6305A779A7269337C515830EE7E4198C6792E72E508A25B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  wimlib64/wimlib-imagex.exe
- Size 110KB
- SHA256 34c0c4165591ad1f592837ed99d08273c58d6ed3fe0ed6360cf34e7b0739b353
- MD5 d80d29f3cfa6c8cacfbfca95e69b493f
- SHA1 66770ed0a79e9a04c0d6ba7dade1aec5027596d3
- SHA512 2362a16f6587d074bc2732cf2ad836a1346573919b37d2b35e091f84caf977554b4adcf9e22019859b585453952bc0544bc5361c2c6ed7e90b530e71be4bc76f
- SSDEEP 1536:ud6ytWthyGTym+YAwwb29KINYBQyCQr9g2vzaR+L2qeWmeaqv2qeWmeaqv+:uUywNymDAwwb2YIAdg2q++
- TLSH
  T108B3B50172E660ACE5B7AA705DF64160AB73BC615838DF2E125CE5791F63E809E30F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Enumerates connected drives

Modifies boot configuration data using bcdedit

Writes to the Master Boot Record (MBR)

Enumerates connected drives

Enumerates connected drives

Maps connected drives based on registry

Writes to the Master Boot Record (MBR)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18