banload | f58301d4b5115342f2c3ef5a7f000c2784cdb2d7a006198d1f86b40a87f86ef2 | Triage

Submit
Reports

Overview

overview

Static

static

3

f58301d4b5...f2.exe

windows7-x64

f58301d4b5...f2.exe

windows10-2004-x64

Sharing

General

Target

f58301d4b5115342f2c3ef5a7f000c2784cdb2d7a006198d1f86b40a87f86ef2
Size

6.1MB
Sample

240523-dh9a5abg24
MD5

fc11bbe60a006ebef9ea994aae3a27cb
SHA1

7ee18f091c19f94e798241b70160110d3a9cf81e
SHA256

f58301d4b5115342f2c3ef5a7f000c2784cdb2d7a006198d1f86b40a87f86ef2
SHA512

bfcac503161d5e23ab4169a8c04a5b3007bbae9611ab71a5566982f6ba0773902131ba5aabed73659dffeaeefba9dcfdc2c088ffd3a530be84d0c9108b3745e6
SSDEEP

98304:J8Gui09qagcP5HSzRmz1bOL+PnXcw+wqNZ1Fyu6TI1DTAFSgjFLOAkGkzdnEVom2:J8GwqavPnsw1sZNtDIFLOyomFHKnP

Score

10^/10

banload downloader dropper evasion trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

f58301d4b5115342f2c3ef5a7f000c2784cdb2d7a006198d1f86b40a87f86ef2.exe

Resource

win7-20240221-en

banload downloader dropper evasion trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

f58301d4b5115342f2c3ef5a7f000c2784cdb2d7a006198d1f86b40a87f86ef2.exe

Resource

win10v2004-20240426-en

banload downloader dropper evasion trojan

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  f58301d4b5115342f2c3ef5a7f000c2784cdb2d7a006198d1f86b40a87f86ef2
- Size
  
  6.1MB
- MD5
  
  fc11bbe60a006ebef9ea994aae3a27cb
- SHA1
  
  7ee18f091c19f94e798241b70160110d3a9cf81e
- SHA256
  
  f58301d4b5115342f2c3ef5a7f000c2784cdb2d7a006198d1f86b40a87f86ef2
- SHA512
  
  bfcac503161d5e23ab4169a8c04a5b3007bbae9611ab71a5566982f6ba0773902131ba5aabed73659dffeaeefba9dcfdc2c088ffd3a530be84d0c9108b3745e6
- SSDEEP
  
  98304:J8Gui09qagcP5HSzRmz1bOL+PnXcw+wqNZ1Fyu6TI1DTAFSgjFLOAkGkzdnEVom2:J8GwqavPnsw1sZNtDIFLOyomFHKnP
Score

10^/10

banload downloader dropper evasion trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

banloaddownloaderdropperevasiontrojan

behavioral2

banloaddownloaderdropperevasiontrojan

© 2018-2024

Terms | Privacy