killmbr | cheese[.]zip

General

Target
cheese.zip
Size 8KB
Sample260816-vmjppsszhy
SHA256 8ce78ebeceeb128fd6ad9a930ef05d0bc558c08b02e9e206ee1b10d01868e4dd
MD5 ddb77085d31f12e82bcbe1c86f81d6ba
SHA1 36ae543591c1f5cc33e6e2cbc1d3dfdf1c35701b
SHA512 f3fd0260555b55fce4821f806a7c68789557ea4c7cb97276f6d27e4e69fb23f8b61743c8395a31c4a015298242b255526bb0372633bc59b5bc355a42d862e717
SSDEEP 192:7e1KR0gqFo11uSePDqLNsjGr28n9i99XU2fEuM5epIQ7kzTGNS65:P07C7u3PDq5siBovU2MuQqkzySO
TLSH
T1C3029E05087E2C99A5643829786FBE7F551026182239AADC3C11B826BE61BC3D13AED2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

wiper trojan killmbr

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
static1/unpack001/cheese.exe	family_killmbr

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cheese.exe

File Explorer

cheese.zip

.zip 8KB
cheese.exe

.exe 14KB

cheese.zip

SHA256 8ce78ebeceeb128fd6ad9a930ef05d0bc558c08b02e9e206ee1b10d01868e4dd
MD5 ddb77085d31f12e82bcbe1c86f81d6ba
SHA1 36ae543591c1f5cc33e6e2cbc1d3dfdf1c35701b
SHA512 f3fd0260555b55fce4821f806a7c68789557ea4c7cb97276f6d27e4e69fb23f8b61743c8395a31c4a015298242b255526bb0372633bc59b5bc355a42d862e717
SSDEEP 192:7e1KR0gqFo11uSePDqLNsjGr28n9i99XU2fEuM5epIQ7kzTGNS65:P07C7u3PDq5siBovU2MuQqkzySO
TLSH
T1C3029E05087E2C99A5643829786FBE7F551026182239AADC3C11B826BE61BC3D13AED2
MD5 SHA1 SHA512 SSDEEP TLSH

Password

1

cheese.exe

IMPHASH 52753d226ff5a8a88caf9829928cd5d1
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects KillMBR
Unsigned PE

Checks for missing Authenticode signature.

Password

1

Minor OS version

1

Major OS version

5

Entry point

4653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cheese.zip

cheese.exe

kernel32

user32

gdi32

advapi32

shell32

winmm

psapi

generic

Sharing

General

Malware Config

Signatures

File Explorer

cheese.zip

cheese.exe

kernel32

user32

gdi32

advapi32

shell32

winmm

psapi

generic