General
- Target ElfBot.zip
- Size 3.3MB
- Sample260819-pf6yrstekd
- SHA256 8b2f0e6e1ea46545861ba30b81356ec4b6cd5f480f349e44d3f89c53f89f4800
- MD5 dfb261125868349e63f0ec6c844a718c
- SHA1 94dace3c1f5b99f9efb01db3b38926e969675e1c
- SHA512 10482f88bd7822571c217eaf08de65b4d255443f9ea0996ef439d797eaa10ea11c83222cc316ce62ea8ac6b001698fc532c8df670b826def9062eeb29e3ac8f6
- SSDEEP 49152:nNOlQyhopP99ixNsNOywbumituC/dpFGBXR3Ad1QFmJz4Hfd4zhnw+d:bNp3YTDCmitZ3MBBiuFSWfim+d
- TLSH T1B8F5338AB2D3F918C4DF695AAD023C6E650918BC2F8774435C92541E2BCCF76C626B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
ElfCrack.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ElfCrack.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup-4.5.9.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target ElfCrack.exe
- Size 1.8MB
- SHA256 1d4cd57394cec1ab32f5fe4f35174a7a8e4157309eb2fde285daa928b9ca6409
- MD5 d041c9f6298132d34df325fefea27b93
- SHA1 a42b53d7a2daf356969d5961aa7d0533bdf0fdc9
- SHA512 5736e1d3bea991b4c335dd9286259955837883e5da2939f3c0ed8f89567afb626dc1c07c4c18d9672394b45e223c137b846fe9e208afe506d857983b15846854
- SSDEEP 24576:1ClhDaf4WHyRM4nswElwMyRpMpm+SZYKnY1kHNdwkn04qWszNusakE2b:1shWHqMeMHyRfHNd+cszNus22b
- TLSH T10585ADD2BBC0459AC6713777806B0BA78495D612ABDC94CBB9F52C131F228C05672BEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target setup-4.5.9.exe
- Size 2.0MB
- SHA256 8c0fe8e8dfa50aa4878d363ec8af50622880ffc2b397f0770c8f33be99cf4f4f
- MD5 7282aa8e4e4453fbc07eb242ffec532f
- SHA1 a313939b89bfa7c76fedd60df4cd4c8f881e227a
- SHA512 ff6bdf2a470f95e7fca45a7d50d19bd9b65a5a41d865e3b73582a45017a716123b61175d83e0e657645f82c901a9f21e7f78e100d9c045de1fb682a71e391a7c
- SSDEEP 49152:/2Zg9mahmfDz9mPNmnKyqbuyWtKgjJjvoJXM:ej3fdMvHCyWt/dQJc
- TLSH T17CA5335A93C6DC38D0A65C359F4271399A1B7DAC3D2A384734ACC4AC4FDDBA2C219763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE