f47bc123831a1855a959fbf51b4138683af7bbbde13ad9f164594d2aa6516791.bin

General
Target

f47bc123831a1855a959fbf51b4138683af7bbbde13ad9f164594d2aa6516791.bin

Size

7MB

Sample

210919-n3gfysefar

Score
10 /10
MD5

473b4e622b982a92cba1ba8afcda8273

SHA1

9a7a192b67895f63f1afdf5adf7ba2d195a17d80

SHA256

f47bc123831a1855a959fbf51b4138683af7bbbde13ad9f164594d2aa6516791

SHA512

bd437fa921c6e2c74d8c8aacc94daf2a560f90ad0fde54004902eb55b009bd705aa9e58e27e49e16f32f962302363e7991af59ba212be0f438909dc5be6032b0

Malware Config
Targets
Target

f47bc123831a1855a959fbf51b4138683af7bbbde13ad9f164594d2aa6516791.bin

MD5

473b4e622b982a92cba1ba8afcda8273

Filesize

7MB

Score
10 /10
SHA1

9a7a192b67895f63f1afdf5adf7ba2d195a17d80

SHA256

f47bc123831a1855a959fbf51b4138683af7bbbde13ad9f164594d2aa6516791

SHA512

bd437fa921c6e2c74d8c8aacc94daf2a560f90ad0fde54004902eb55b009bd705aa9e58e27e49e16f32f962302363e7991af59ba212be0f438909dc5be6032b0

Tags

Signatures

  • Detect Numando Payload

  • Numando

    Description

    Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.

    Tags

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    Tags

    TTPs

    Query Registry Virtualization/Sandbox Evasion
  • Checks BIOS information in registry

    Description

    BIOS information is often read in order to detect sandboxing environments.

    TTPs

    Query Registry System Information Discovery
  • Themida packer

    Description

    Detects Themida, an advanced Windows software protection system.

    Tags

  • Checks whether UAC is enabled

    Tags

    TTPs

    System Information Discovery

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Tasks

                      static1

                      7/10