Overview

overview

10

Static

static

8f236ac211...56.exe

windows7_x64

10

8f236ac211...56.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56

  • Size

    2.8MB

  • Sample

    220124-fvey6acea9

  • MD5

    4cf6cc9fafde5d516be35f73615d3f00

  • SHA1

    f4b9c366a50fa20013d70730f9e260534e59a846

  • SHA256

    8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56

  • SHA512

    f9670cbda474606b17302fab11dc5e5fff1ecf1414454f30293a5650e4e4458d6f687e642f4f8b5c154b5619382fd06a043517ffc5d1ffc0d5344fc3b3763a05

Score
10/10
banloadbootkitdownloaderdropperevasionpersistencetrojan

Malware Config

Targets

    • Target

      8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56

    • Size

      2.8MB

    • MD5

      4cf6cc9fafde5d516be35f73615d3f00

    • SHA1

      f4b9c366a50fa20013d70730f9e260534e59a846

    • SHA256

      8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56

    • SHA512

      f9670cbda474606b17302fab11dc5e5fff1ecf1414454f30293a5650e4e4458d6f687e642f4f8b5c154b5619382fd06a043517ffc5d1ffc0d5344fc3b3763a05

    Score
    10/10
    banloadbootkitdownloaderdropperevasionpersistencetrojan

    • Banload

      Banload variants download malicious files, then install and execute the files.

      trojandropperdownloaderbanload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks