Overview

overview

10

Static

static

3

datainform.scr

windows7-x64

10

datainform.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f61e7bb3b23c901a6667ddba0c5a5682

  • Size

    1.8MB

  • Sample

    231222-t55jfscba9

  • MD5

    f61e7bb3b23c901a6667ddba0c5a5682

  • SHA1

    1f90b0609f02ad2b95214a65082dc5260face27f

  • SHA256

    c354051e40c306d7a6b0dd860931d6084aea34385b5e4c342281dd92e47bb639

  • SHA512

    7c8329be637527540c61771d650b9c7892ef392070f7140c829d7480025a16abca46484c33b72a7cafb59d73cdfa867a5ff6d23829241e84acc81d78171a67ad

  • SSDEEP

    49152:o3NRxRwIF7lPZGdZzIT7cuF+RgWU9JB71BULu12zRpa:od7iI1lIM+CvJVj4zu

Score
10/10
banloaddiscoverydownloaderdropperevasionpersistencetrojan

Malware Config

Targets

    • Target

      datainform.scr

    • Size

      1.9MB

    • MD5

      c7e0400dd92745e76a802f62bbdfa258

    • SHA1

      5990ba07cb55111fc5b610b1bd1f1c4d60eaa5fa

    • SHA256

      303b173796a39a53de197d6e2c68bbe3cb0227a4f40c318c6ae329e7ee804c27

    • SHA512

      ed484a9c80908c1d72bae77943a722ebb86f8dc87a80a9f8d6c33b3b616988db26303f14919e16b854a57354b259c9d883ab7662fa5eb04e154963390da194a2

    • SSDEEP

      49152:mXz+6rnxVOib7LBZqRuiyT7QuXEUcfU1fbBULG125Bm:mXz+IxQiHLW8tAsVS5Bm

    Score
    10/10
    banloaddiscoverydownloaderdropperevasiontrojanpersistence

    • Banload

      Banload variants download malicious files, then install and execute the files.

      trojandropperdownloaderbanload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks