killmbr | 5471b072df127f8417338cb7eb0386c17eeb177771183695e994886fcfd44a05

General

Target
GTAVI_CE_CE_Map_1x1_Finalized_2160noise.png
Size 218KB
Sample261011-ner8jsts7n
SHA256 5471b072df127f8417338cb7eb0386c17eeb177771183695e994886fcfd44a05
MD5 7bd8f0562ddbfaef4bea6e3682d8a3bc
SHA1 2e2fabb46b50f546710fd4f0d297c3ee71316f27
SHA512 c8ba0f1e3168d592335a95d76f0c6dff89880801a5924d80424bb7634f915e44b18f5425ce478490205741813b9ca9635f3fa1ee265aab5f6c3b71920a9db5d9
SSDEEP 6144:JmatmQTU/Oi7xFrZDn19114jijgHITHCZ32zwrI:JmatpTU/Oi7p1z1rCKd
TLSH
T1AD2422F3FB58598ECD4561BC186C96510E99AEB1FBE20EC78E0633004C5E611A7BA1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  GTAVI_CE_CE_Map_1x1_Finalized_2160noise.png
- Size 218KB
- SHA256 5471b072df127f8417338cb7eb0386c17eeb177771183695e994886fcfd44a05
- MD5 7bd8f0562ddbfaef4bea6e3682d8a3bc
- SHA1 2e2fabb46b50f546710fd4f0d297c3ee71316f27
- SHA512 c8ba0f1e3168d592335a95d76f0c6dff89880801a5924d80424bb7634f915e44b18f5425ce478490205741813b9ca9635f3fa1ee265aab5f6c3b71920a9db5d9
- SSDEEP 6144:JmatmQTU/Oi7xFrZDn19114jijgHITHCZ32zwrI:JmatpTU/Oi7p1z1rCKd
- TLSH
  T1AD2422F3FB58598ECD4561BC186C96510E99AEB1FBE20EC78E0633004C5E611A7BA1E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit defense_evasion discovery execution killmbr persistence ransomware spyware trojan wiper
- Detects KillMBR
- Family: KillMBR
  KillMBR is a trojan that attempts to overwrite the Master Boot Record.
  wiper trojan killmbr
- Renames multiple (6153) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2