killmbr | 3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61

General

Target
memz.by.iTzDrK_ (1).rar
Size 17KB
Sample260922-1aeg4ssfpc
SHA256 3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61
MD5 352c9d71fa5ab9e8771ce9e1937d88e9
SHA1 7ef6ee09896dd5867cff056c58b889bb33706913
SHA512 6c133aa0c0834bf3dbb3a4fb7ff163e3b17ae2500782d6bba72812b4e703fb3a4f939a799eeb17436ea24f225386479d3aa3b81fdf35975c4f104914f895ff23
SSDEEP 384:7FbiYdriLCwBoe6POLT9bxaF851AfS9KL6bPsn/OMrZAGE:7FbldrliOSbxr1AfS9KM+/OMa1
TLSH
T18282D04E4133B86024BE329DE1B9477AABC65B8A3CC4345EAAFC5F13C14CC30EA255A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  memz.by.iTzDrK_ (1).rar
- Size 17KB
- SHA256 3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61
- MD5 352c9d71fa5ab9e8771ce9e1937d88e9
- SHA1 7ef6ee09896dd5867cff056c58b889bb33706913
- SHA512 6c133aa0c0834bf3dbb3a4fb7ff163e3b17ae2500782d6bba72812b4e703fb3a4f939a799eeb17436ea24f225386479d3aa3b81fdf35975c4f104914f895ff23
- SSDEEP 384:7FbiYdriLCwBoe6POLT9bxaF851AfS9KL6bPsn/OMrZAGE:7FbldrliOSbxr1AfS9KM+/OMa1
- TLSH
  T18282D04E4133B86024BE329DE1B9477AABC65B8A3CC4345EAAFC5F13C14CC30EA255A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit discovery execution killmbr persistence spyware trojan wiper
- Detects KillMBR
- Family: KillMBR
  KillMBR is a trojan that attempts to overwrite the Master Boot Record.
  wiper trojan killmbr
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1
- Target
  Geometry dash auto speedhack.bat
- Size 13KB
- SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
- MD5 4e2a7f369378a76d1df4d8c448f712af
- SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
- SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
- SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
- TLSH
  T1BB528D3236754E13193326CB5C3AA256BCF4503F761A6E71A4138DFB90AAFD1319EB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit discovery execution killmbr persistence spyware trojan wiper
- Detects KillMBR
- Family: KillMBR
  KillMBR is a trojan that attempts to overwrite the Master Boot Record.
  wiper trojan killmbr
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral2
- Target
  geometry dash auto speedhack.exe
- Size 14KB
- SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
- MD5 19dbec50735b5f2a72d4199c4e184960
- SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
- SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
- SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
- TLSH
  T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral3