Overview

overview

6

Static

static

3

TransFlash...ro.exe

windows10-2004-x64

6

TransFlash...ro.exe

windows11-ltsc_2024-x64

6

TransFlash...mt.exe

windows10-2004-x64

3

TransFlash...mt.exe

windows11-ltsc_2024-x64

3

TransFlash...mt.exe

windows10-2004-x64

6

TransFlash...mt.exe

windows11-ltsc_2024-x64

6

TransFlash...lc.exe

windows10-2004-x64

3

TransFlash...lc.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    e00e5b0d145923d85a7b6e2f0961b4b077ef7d10bae5d0a95399a7b79992099d
  • Size 481KB
  • Sample260825-lc1e2agm5v
  • SHA256 e00e5b0d145923d85a7b6e2f0961b4b077ef7d10bae5d0a95399a7b79992099d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target
      TransFlash TF Card Format Tool Pro 3_2/TFCardFormatToolPro.exe
    • Size 823KB
    • SHA256 f6e6e5705e992f16369eeb43e8bd7db14e02a496f5fee71e048541266d780a61
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdiscoverypersistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2
    • Target
      TransFlash TF Card Format Tool Pro 3_2/tvfmt.exe
    • Size 110KB
    • SHA256 96e57fdd4c97ab18802587a77e22deaaf7c4d34b92cfdf4fe00ef02a9a47345a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      TransFlash TF Card Format Tool Pro 3_2/usbfmt.exe
    • Size 100KB
    • SHA256 33db1ddeb29512446a54beb3a78da4c30aadfbce553dc1d8b8b023253b5201ca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdiscoverypersistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral5behavioral6
    • Target
      TransFlash TF Card Format Tool Pro 3_2/usbutilc.exe
    • Size 97KB
    • SHA256 0f2f61002ce58a3a7fa45df956124dfbc23dda4521661aecb8a3d23f1305d7a4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v16

Tasks