c7f4241711a45056afd037c696cb45da0f7c1be629b1280fef521e8aa7c47f33

General

Target
XBinderOutput.exe
Size 1.5MB
Sample260814-16w22atwbx
SHA256 c7f4241711a45056afd037c696cb45da0f7c1be629b1280fef521e8aa7c47f33
MD5 4f31be8f6499ee6b7a1c2f2967390354
SHA1 b379d825ed09cb0d0c5bdd9d5f316519a2344894
SHA512 94226543f3a583f88d617a1426b2e6e1a448ec3d5c6d6da45396b137a799936995d71a783d43c846883a769d23d2964601d43b602dab731730b38a0d2d698bba
SSDEEP 49152:nLIHhu/VofMtX2fyWWbf++RIFTBYber0:nLeiy2Xva+RIFO6
TLSH
T19B7533A5B6B7A23ACDD733327CF77848565A723E4776376D08A9F32B4D029801326C54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  XBinderOutput.exe
- Size 1.5MB
- SHA256 c7f4241711a45056afd037c696cb45da0f7c1be629b1280fef521e8aa7c47f33
- MD5 4f31be8f6499ee6b7a1c2f2967390354
- SHA1 b379d825ed09cb0d0c5bdd9d5f316519a2344894
- SHA512 94226543f3a583f88d617a1426b2e6e1a448ec3d5c6d6da45396b137a799936995d71a783d43c846883a769d23d2964601d43b602dab731730b38a0d2d698bba
- SSDEEP 49152:nLIHhu/VofMtX2fyWWbf++RIFTBYber0:nLeiy2Xva+RIFO6
- TLSH
  T19B7533A5B6B7A23ACDD733327CF77848565A723E4776376D08A9F32B4D029801326C54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery execution persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Disables Task Manager via registry modification
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1