General

  • Target

    6187c58f85a2e53c84e90e7ef2866212

  • Size

    1.6MB

  • Sample

    231222-etxxxaefg9

  • MD5

    6187c58f85a2e53c84e90e7ef2866212

  • SHA1

    eca641725773005ad63910714201e9b660795671

  • SHA256

    eb7f30ed4f37fd13e54b87e03f487e2493facae75fe88f1a31366a84579fc2fa

  • SHA512

    d9b00786b4a95dd94794b94ee2f212ebd8e995fad34889df771ddab0b40add05ff11b7783aa48a2d27a58bcd13edf18cdf5b0a9253086837d449415776a07d32

  • SSDEEP

    49152:OXz+F0VcOT8RyELdnVGRBOhQcY9loE0kSYB:OXz+PLdnVKOhQcYjoE0T+

Malware Config

Targets

    • Target

      6187c58f85a2e53c84e90e7ef2866212

    • Size

      1.6MB

    • MD5

      6187c58f85a2e53c84e90e7ef2866212

    • SHA1

      eca641725773005ad63910714201e9b660795671

    • SHA256

      eb7f30ed4f37fd13e54b87e03f487e2493facae75fe88f1a31366a84579fc2fa

    • SHA512

      d9b00786b4a95dd94794b94ee2f212ebd8e995fad34889df771ddab0b40add05ff11b7783aa48a2d27a58bcd13edf18cdf5b0a9253086837d449415776a07d32

    • SSDEEP

      49152:OXz+F0VcOT8RyELdnVGRBOhQcY9loE0kSYB:OXz+PLdnVKOhQcYjoE0T+

    • Banload

      Banload variants download malicious files, then install and execute the files.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks