Overview

overview

10

Static

static

bomani2.exe

windows10-2004-x64

10

Resubmissions

18-08-2022 13:44

220818-q18hrsaca7 10

30-03-2022 09:01

220330-ky21bafbdq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bomani2.exe

  • Size

    56KB

  • Sample

    220818-q18hrsaca7

  • MD5

    cadf573e4ca120639a1e5484e985938d

  • SHA1

    ff0d09efbb1495982073291351a81de59e2c3c0d

  • SHA256

    7375b2047d519fffcbe1191522efbf73dcda6073a4fc9b77f01f009c437a2fe8

  • SHA512

    a8496afe762828b23f3568c49954a7c84c2390e0b2d2bb54c141fa9af2db390fd1f0a7582a006ed2b315fd074e4a2268bfdc52a1923f1a28e706000db92015ef

  • SSDEEP

    1536:gmPeytM3alnawrRIwxVSHMweio3yHLBCo:pPey23alnaEIN/WyHLBCo

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      bomani2.exe

    • Size

      56KB

    • MD5

      cadf573e4ca120639a1e5484e985938d

    • SHA1

      ff0d09efbb1495982073291351a81de59e2c3c0d

    • SHA256

      7375b2047d519fffcbe1191522efbf73dcda6073a4fc9b77f01f009c437a2fe8

    • SHA512

      a8496afe762828b23f3568c49954a7c84c2390e0b2d2bb54c141fa9af2db390fd1f0a7582a006ed2b315fd074e4a2268bfdc52a1923f1a28e706000db92015ef

    • SSDEEP

      1536:gmPeytM3alnawrRIwxVSHMweio3yHLBCo:pPey23alnaEIN/WyHLBCo

    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks