killmbr | 240903-swfnaszgjk_pw_infected[.]zip

General

Target
240903-swfnaszgjk_pw_infected.zip
Size 9KB
Sample260918-vs7nqaae46
SHA256 ba5f7213cda3a7b110c1cae536218c72051d8ccc07710f8770204a50f55e0082
MD5 5ae32f2a95b5c0d134ff3022c5e57649
SHA1 99a2aa65ab667d7bb83f38733ac7727174f75f74
SHA512 74efa37b69b65a73390e852ef80afc830dd2803441ef9cd985a41af45634af1366d85d6aa9963cee8610ee540c8940f228a4f681c500a6a9a722e3c3cde57ca8
SSDEEP 192:/ccD1GHnXFIIKgKTHqSXxSiKm//4HY9Rx6iaZIsCh8JCV:vcHnGI6q+VJX44pkCKJc
TLSH
T13812AFD8DB91D75AD9C0511F19995E94F5349064231389B3CEBC60F43CA6AC22F8D2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

wiper trojan killmbr

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
static1/unpack001/MEMZ.exe	family_killmbr

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MEMZ.exe

File Explorer

240903-swfnaszgjk_pw_infected.zip

.zip 9KB
MEMZ.exe

.exe 16KB

240903-swfnaszgjk_pw_infected.zip

SHA256 ba5f7213cda3a7b110c1cae536218c72051d8ccc07710f8770204a50f55e0082
MD5 5ae32f2a95b5c0d134ff3022c5e57649
SHA1 99a2aa65ab667d7bb83f38733ac7727174f75f74
SHA512 74efa37b69b65a73390e852ef80afc830dd2803441ef9cd985a41af45634af1366d85d6aa9963cee8610ee540c8940f228a4f681c500a6a9a722e3c3cde57ca8
SSDEEP 192:/ccD1GHnXFIIKgKTHqSXxSiKm//4HY9Rx6iaZIsCh8JCV:vcHnGI6q+VJX44pkCKJc
TLSH
T13812AFD8DB91D75AD9C0511F19995E94F5349064231389B3CEBC60F43CA6AC22F8D2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

MEMZ.exe

IMPHASH 2eb516ca11536a75b455bb2361a5a574
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
TLSH
T10F725CCFFAA00457E4F0C93030656634EF7E9A7A0B968EDF6CF52E829AC0D472517295
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects KillMBR
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

240903-swfnaszgjk_pw_infected.zip

MEMZ.exe

kernel32

user32

gdi32

advapi32

shell32

winmm

psapi

generic

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

240903-swfnaszgjk_pw_infected.zip

MEMZ.exe

kernel32

user32

gdi32

advapi32

shell32

winmm

psapi

generic