General
- Target GTAVI_CE_CE_Map_1x1_Finalized_2160noise.png
- Size 218KB
- Sample260930-d8gc2avbkc
- SHA256 5471b072df127f8417338cb7eb0386c17eeb177771183695e994886fcfd44a05
Score
10/10
Malware Config
Targets
-
- Target GTAVI_CE_CE_Map_1x1_Finalized_2160noise.png
- Size 218KB
- SHA256 5471b072df127f8417338cb7eb0386c17eeb177771183695e994886fcfd44a05
Score10/10-
Detects KillMBR
-
Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1