Overview

overview

10

Static

static

f2e58ee295...ed.dll

windows7_x64

10

f2e58ee295...ed.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f2e58ee2957e8000552cd12aec3773a0d70f67170f4dffc0b0eb5d4da85077ed

  • Size

    4.3MB

  • Sample

    220414-gmqalahaa8

  • MD5

    80ff198cb4385824119be0dbae268a88

  • SHA1

    82a0c9d7f9c2ecc22b6ab3c597a6632987b7427f

  • SHA256

    f2e58ee2957e8000552cd12aec3773a0d70f67170f4dffc0b0eb5d4da85077ed

  • SHA512

    c1a4f761174c8ee038708dcd2c95a5e954c4bc8f1697afd3e007408377e0cd7db5761fc8930081955d743fe77198c62d1f4a5324a481486c4d09ac02053f1829

Score
10/10
banloadnumandobackdoordownloaderdropperevasiontrojan

Malware Config

Targets

    • Target

      f2e58ee2957e8000552cd12aec3773a0d70f67170f4dffc0b0eb5d4da85077ed

    • Size

      4.3MB

    • MD5

      80ff198cb4385824119be0dbae268a88

    • SHA1

      82a0c9d7f9c2ecc22b6ab3c597a6632987b7427f

    • SHA256

      f2e58ee2957e8000552cd12aec3773a0d70f67170f4dffc0b0eb5d4da85077ed

    • SHA512

      c1a4f761174c8ee038708dcd2c95a5e954c4bc8f1697afd3e007408377e0cd7db5761fc8930081955d743fe77198c62d1f4a5324a481486c4d09ac02053f1829

    Score
    10/10
    banloadnumandobackdoordownloaderdropperevasiontrojan

    • Banload

      Banload variants download malicious files, then install and execute the files.

      trojandropperdownloaderbanload

    • Detect Numando Payload

    • Numando

      Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.

      trojanbackdoornumando

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks