killmbr | memz[.]by[.]iTzDrK_[.]rar

General

Target
memz.by.iTzDrK_.rar
Size 17KB
Sample260922-wx9vbace39
SHA256 3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61
MD5 352c9d71fa5ab9e8771ce9e1937d88e9
SHA1 7ef6ee09896dd5867cff056c58b889bb33706913
SHA512 6c133aa0c0834bf3dbb3a4fb7ff163e3b17ae2500782d6bba72812b4e703fb3a4f939a799eeb17436ea24f225386479d3aa3b81fdf35975c4f104914f895ff23
SSDEEP 384:7FbiYdriLCwBoe6POLT9bxaF851AfS9KL6bPsn/OMrZAGE:7FbldrliOSbxr1AfS9KM+/OMa1
TLSH
T18282D04E4133B86024BE329DE1B9477AABC65B8A3CC4345EAAFC5F13C14CC30EA255A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

wiper trojan killmbr

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
static1/unpack001/geometry dash auto speedhack.exe	family_killmbr

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/geometry dash auto speedhack.exe

File Explorer

memz.by.iTzDrK_.rar

.rar 17KB
Geometry dash auto speedhack.bat

.bat .vbs 13KB
geometry dash auto speedhack.exe

.exe 14KB

memz.by.iTzDrK_.rar

SHA256 3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61
MD5 352c9d71fa5ab9e8771ce9e1937d88e9
SHA1 7ef6ee09896dd5867cff056c58b889bb33706913
SHA512 6c133aa0c0834bf3dbb3a4fb7ff163e3b17ae2500782d6bba72812b4e703fb3a4f939a799eeb17436ea24f225386479d3aa3b81fdf35975c4f104914f895ff23
SSDEEP 384:7FbiYdriLCwBoe6POLT9bxaF851AfS9KL6bPsn/OMrZAGE:7FbldrliOSbxr1AfS9KM+/OMa1
TLSH
T18282D04E4133B86024BE329DE1B9477AABC65B8A3CC4345EAAFC5F13C14CC30EA255A1
MD5 SHA1 SHA512 SSDEEP TLSH

geometry dash auto speedhack.exe

IMPHASH 52753d226ff5a8a88caf9829928cd5d1
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects KillMBR
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

memz.by.iTzDrK_.rar

Geometry dash auto speedhack.bat

geometry dash auto speedhack.exe

kernel32

user32

gdi32

advapi32

shell32

winmm

psapi

generic

Sharing

General

Malware Config

Signatures

File Explorer

memz.by.iTzDrK_.rar

Geometry dash auto speedhack.bat

geometry dash auto speedhack.exe

kernel32

user32

gdi32

advapi32

shell32

winmm

psapi

generic