Overview

overview

8

Static

static

3

salinewin-safety.exe

windows10-ltsc_2021-x64

3

salinewin.exe

windows10-ltsc_2021-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    salinewin.zip
  • Size 203KB
  • Sample260808-xffetaxsd1
  • SHA256 b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
bootkitdefense_evasiondiscoveryexecutionpersistence

Malware Config

Targets

    • Target
      salinewin-safety.exe
    • Size 245KB
    • SHA256 279a19315055e93a80c558bf9d9a7c8b4aba8fc8f8f3e812df8619e959abbcae
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1
    • Target
      salinewin.exe
    • Size 283KB
    • SHA256 7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    bootkitdefense_evasiondiscoveryexecutionpersistence

    • Disables Task Manager via registry modification

      defense_evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral2

MITRE ATT&CK Enterprise v16

Tasks