515735431d4620d67959062613c093c786e79fd2fefe90e91bf809d131b0a41a

General

Target
b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.zip
Size 151KB
Sample260827-trnc1swzhy
SHA256 515735431d4620d67959062613c093c786e79fd2fefe90e91bf809d131b0a41a
MD5 ce675ff67229f3a7be82cf90d3d27fe9
SHA1 2f540f5812ae6ad648e581cae746210e982958f2
SHA512 00d042abaea94d151488a74bf2461486753712ac77972af5a07e98a7b44ab79fcba270dfab5d749af552ee0ee8d2717e3035fdda638b8513702429b1002e095d
SSDEEP 3072:Nr4J+vRWO4S4UZHbnw5S/z7QZXIDKJLAb4tJ2JVG4Y:iJ+f40MU7EWK69JVGJ
TLSH
T187E3132FCF08DB975F51B6721B19CFDC9126C2D813B5D4C7230E594B39DAC95A23A211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.zip
- Size 151KB
- SHA256 515735431d4620d67959062613c093c786e79fd2fefe90e91bf809d131b0a41a
- MD5 ce675ff67229f3a7be82cf90d3d27fe9
- SHA1 2f540f5812ae6ad648e581cae746210e982958f2
- SHA512 00d042abaea94d151488a74bf2461486753712ac77972af5a07e98a7b44ab79fcba270dfab5d749af552ee0ee8d2717e3035fdda638b8513702429b1002e095d
- SSDEEP 3072:Nr4J+vRWO4S4UZHbnw5S/z7QZXIDKJLAb4tJ2JVG4Y:iJ+f40MU7EWK69JVGJ
- TLSH
  T187E3132FCF08DB975F51B6721B19CFDC9126C2D813B5D4C7230E594B39DAC95A23A211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
- Size 406KB
- SHA256 b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b
- MD5 e9e6e925876eb3bb02f09cfc1965aacc
- SHA1 c8905cffc8022087a47343197fe8153089cbd6d7
- SHA512 d4fa5be81f2cae769119191f77e6da3f79004f7d62a1822d7ce34a100ba7af04290a5647efaa9400da3d7d87964d19a78e8573c488fb11334d0b0bf954220974
- SSDEEP 6144:KiXU4/N1hEcaiQ+GTWH/obazxU95VGYT9T:KikYbWcaivGTjV959T
- TLSH
  T1ED947D82B7C66DD9D2158A3589EF83293738F5E11A439F1B093472350D23AD0FE97A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit defense_evasion execution persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral2