Overview

overview

10

Static

static

10

5d7aa3474e...ba.exe

windows7_x64

10

5d7aa3474e...ba.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5d7aa3474e734913ecb4b820c0c546c92f7684081c519eecd3990e11a19bf2ba

  • Size

    4MB

  • Sample

    210712-wkkvyz6vax

  • MD5

    15e8a6b8e6f7497ff3b858d3bad7f0c3

  • SHA1

    f672aa3a40647f3f1c724e1e6279e09332e5df18

  • SHA256

    5d7aa3474e734913ecb4b820c0c546c92f7684081c519eecd3990e11a19bf2ba

  • SHA512

    4857e5eaa32dca2159a25465bcb389568dc5376f79901dacd8bcc103be052e81cba2563721cf34409507b89939e2dc97ce11624e75408d6c01147db2e2635e5d

Score
10/10
biopassdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      5d7aa3474e734913ecb4b820c0c546c92f7684081c519eecd3990e11a19bf2ba

    • Size

      4MB

    • MD5

      15e8a6b8e6f7497ff3b858d3bad7f0c3

    • SHA1

      f672aa3a40647f3f1c724e1e6279e09332e5df18

    • SHA256

      5d7aa3474e734913ecb4b820c0c546c92f7684081c519eecd3990e11a19bf2ba

    • SHA512

      4857e5eaa32dca2159a25465bcb389568dc5376f79901dacd8bcc103be052e81cba2563721cf34409507b89939e2dc97ce11624e75408d6c01147db2e2635e5d

    Score
    10/10
    biopassrattrojandiscoverypersistence

    • biopass

      BIOPASS is a RAT connected with Winnti group (APT41).

      rattrojanbiopass

    • family_biopass

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Tasks