General
- Target 18a87de8c68907ebb646f475ae83e9ad3e6391a1d3e785c38e0b7529555e395b
- Size 2.0MB
- Sample260903-ymj71svdqd
- SHA256 18a87de8c68907ebb646f475ae83e9ad3e6391a1d3e785c38e0b7529555e395b
- MD5 e2600ac3127ed5548d83d1a2187d09b5
- SHA1 f7300a06ad5191cfeccbca6f1a14fd3f7d88d606
- SHA512 46cfe3941f05221dc41c87fa94d0263a9a3a439a1be9310250f794a0165f713f2fcdb8ef95c13b55be6ce8e238e6f2f05b344b98fce11093d7ac9a48602985b5
- SSDEEP 24576:xXNrSLScusMmOvjjhzvLV0aygkcXjPeynRkIegf+Sve+9Cx+gBbfWzOUxSXc64dV:KuI2hCHcTeynRkfg7ve+AhrWzOUz
- TLSH T1F6A5D03FB28B653EE06E5A367A72E210583B7A6165138C5696F4C88CCF254701E3F787
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
18a87de8c68907ebb646f475ae83e9ad3e6391a1d3e785c38e0b7529555e395b.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 18a87de8c68907ebb646f475ae83e9ad3e6391a1d3e785c38e0b7529555e395b
- Size 2.0MB
- SHA256 18a87de8c68907ebb646f475ae83e9ad3e6391a1d3e785c38e0b7529555e395b
- MD5 e2600ac3127ed5548d83d1a2187d09b5
- SHA1 f7300a06ad5191cfeccbca6f1a14fd3f7d88d606
- SHA512 46cfe3941f05221dc41c87fa94d0263a9a3a439a1be9310250f794a0165f713f2fcdb8ef95c13b55be6ce8e238e6f2f05b344b98fce11093d7ac9a48602985b5
- SSDEEP 24576:xXNrSLScusMmOvjjhzvLV0aygkcXjPeynRkIegf+Sve+9Cx+gBbfWzOUxSXc64dV:KuI2hCHcTeynRkfg7ve+AhrWzOUz
- TLSH T1F6A5D03FB28B653EE06E5A367A72E210583B7A6165138C5696F4C88CCF254701E3F787
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks for any installed AV software in registry
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1