General
- Target WPS_UpdatePatch_26895.exe
- Size 3.8MB
- Sample260804-gzaqnssfre
- SHA256 b8edda96132ecb8e9d47330d25980c716224027017b2cca0915418ed97f87217
Score
6/10
Malware Config
Targets
-
- Target WPS_UpdatePatch_26895.exe
- Size 3.8MB
- SHA256 b8edda96132ecb8e9d47330d25980c716224027017b2cca0915418ed97f87217
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
Score3/10 -
- Target wtoolex/updateself.exe
- Size 3.7MB
- SHA256 36ccf389677dd1523d31e8d0cab6d5f534ad8715cac5bd04114a1f5dc8947b13
Score3/10 -
- Target wtoolex/wpsupdate.exe
- Size 6.0MB
- SHA256 4083226d1b855a6b104c7d2d37ca9fb550805bb1216ae11af1c3178d28924d84
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.