killmbr | hxxps://archive[.]org/details/malware-pack

General

Target
https://archive.org/details/malware-pack
Sample260824-177vxscr5t

Score

10^/10

Malware Config

Targets

- Target
  https://archive.org/details/malware-pack
Score

10^/10

adware defense_evasion discovery execution killmbr installer persistence ransomware spyware stealer trojan wiper
- Detects KillMBR
- Family: KillMBR
  KillMBR is a trojan that attempts to overwrite the Master Boot Record.
  wiper trojan killmbr
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- System Binary Proxy Execution: Verclsid
  Adversaries may abuse Verclsid to proxy execution of malicious code.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2