Overview

overview

10

Static

static

10

7f4e02a041...c0.exe

windows7_x64

10

7f4e02a041...c0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f4e02a041ca7cfbdc79b96a890822fd7c37be67b1f6c9e07596e6aec57ccdc0

  • Size

    4.8MB

  • Sample

    210712-yxk37n5r9x

  • MD5

    0bbe5966c5ea998605215df6ef88ad90

  • SHA1

    bce97a45e856b71dc8d48ae12b04f69eb6d191d1

  • SHA256

    7f4e02a041ca7cfbdc79b96a890822fd7c37be67b1f6c9e07596e6aec57ccdc0

  • SHA512

    14b74fc9dcd6249bd9c4e4d0a41137898864f7d936d1a4964e212c1f13e60f846107d176d32aba65dac649cc8899d6842744e2909e813f7ab32ece8023a2a3dd

Score
10/10
biopassdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      7f4e02a041ca7cfbdc79b96a890822fd7c37be67b1f6c9e07596e6aec57ccdc0

    • Size

      4.8MB

    • MD5

      0bbe5966c5ea998605215df6ef88ad90

    • SHA1

      bce97a45e856b71dc8d48ae12b04f69eb6d191d1

    • SHA256

      7f4e02a041ca7cfbdc79b96a890822fd7c37be67b1f6c9e07596e6aec57ccdc0

    • SHA512

      14b74fc9dcd6249bd9c4e4d0a41137898864f7d936d1a4964e212c1f13e60f846107d176d32aba65dac649cc8899d6842744e2909e813f7ab32ece8023a2a3dd

    Score
    10/10
    biopassrattrojandiscoverypersistence

    • biopass

      BIOPASS is a RAT connected with Winnti group (APT41).

      rattrojanbiopass

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks