2bad3df182a616c0d93fdc35ad1a629ef76101cf2222294070ba84a4ee52ecb2

General

Target
Desktop (1).rar
Size 23KB
Sample261014-prs62sc16w
SHA256 2bad3df182a616c0d93fdc35ad1a629ef76101cf2222294070ba84a4ee52ecb2
MD5 077e92a46471ebbb0ff45aa529631ab8
SHA1 99a67d542b70eef2376f58defde3ddc9d9274b13
SHA512 5ae053e9c8b3614eecb5cbd1782ae863f5599e8c54a18a85bdecc4ff0031aec73fe080515f527f31c7b22cbf1886f4b290b5c7d89bede30debbcc496f286bad6
SSDEEP 384:fyRF/ujVxjaCBtP3lu+anpGDvy721YX9BB+lZmympl4wtI6u7A670OW8ZYDEUVlU:aRFKV5a6fu+ansawYXwZmzpl4wsA61FP
TLSH
T15CB2E1710C85F65EB0E2FC18C9311FCDE4E8AD9888B05229BE0FC4B285C4FE4AD5DA94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2.exe
- Size 18KB
- SHA256 9fcb9e513cfe34500707cb950e17baab6631ca455ed22fa647346c955df43b82
- MD5 2923af1a6cd320dd811789afe59a2183
- SHA1 fdc33843a29872c42d3e5d73de181af618685b2c
- SHA512 e43b09804bf0f3c056b240cba3549f31a4ad7a34e28e4f071c282c20a9de9bf6c4f1647f82228f78967885f7d030924f99f3ace1dd98910219b270276c9a4fea
- SSDEEP 384:8yGTIkP6QpBh/mLu12ekubSN9InZw/CFJi69dBgr9Y4:WTHymhuukF94jL4
- TLSH
  T1DD823C48FFD4C258E1BD0B3A49F3131E4631E5599E03DB8E18DD829E1F71AE946407E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit execution persistence
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  3.exe
- Size 14KB
- SHA256 6c099effcacee3c0572925a6084b39efc56e5d37110a0301d7775742bfc13dcd
- MD5 6ccfab5f4d27f02d8c79cd7442519290
- SHA1 f22864cad119a3e074e8a3f1619e46a63a91abf7
- SHA512 4377257e45d8ceb2b82b39958c2c8e97048acdf2df3f0c39280e506c490cdd3cc631d1f791ae98f798656ed5c8535e0a152cb4c336520ab0ed7badd9d846e853
- SSDEEP 384:/2KNueTrZumZOLoTer9ZSZwnZFJp0Bgr9Y4:ubWdIr9TuL4
- TLSH
  T1A2620804EBE88794EABD0F3969F313554231E4E3D903CB8D18E4025B7E71BD59600BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit execution persistence
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral3 behavioral4
- Target
  q.exe
- Size 16KB
- SHA256 b9bdd5e535db93c9d6fd0b29b91383ac6c1c40304519796894f7958265ad3c57
- MD5 af3cdc7cd49c4091f72464d65a83953d
- SHA1 a7531b80fefb9c9c8ea9209147c867495a9ba2ff
- SHA512 00a5fd43092811edb7452d8416a293b316eb0ff0a22e42c2c92684574be29f848829ec46dcd97fdaa7387d0fa16979fb615e2b78d008a094738cea51113b171c
- SSDEEP 384:jsWdC0Gu+ALtmlItV5IAgeMy9kSZwudFJQfBgr9Y4:gWdCpytz3Tr9XkL4
- TLSH
  T1B2722A44EBF98314D77E0B7A29F313154A31F9969E03CB8F28EC42667E71AD49640BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit execution persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral5 behavioral6