Overview

overview

10

Static

static

1

Trojan_Rem....6.exe

windows7-x64

10

Trojan_Rem....6.exe

windows10-2004-x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trojan_Remover_V6.9.6.exe

  • Size

    20.9MB

  • Sample

    240818-gw454ssejq

  • MD5

    b99984ad78f818d34c5ed599d312a2e1

  • SHA1

    893ffbaf835653ed197fccb8c756ad21a679a081

  • SHA256

    f7f8880582210c104511885f52112ef6bb8977775dd3e3343c62e6d9e196f3e8

  • SHA512

    ff293cf4757232a786e17e0bf825bed6325e6b713477381ad849379d3bb7d18ef1b33ffaefda766f1296809f15092a6bc2970cb5d860dbf23ad8c731814ab271

  • SSDEEP

    393216:dYm0BJS9+7GOq1GHZhOZjHlHAoYJ/fpQwa83E0vZkLB2oXJp5hT3MaVm+y:+M+t+IbOZHlgB/fpWmEwZkLMw38x+y

Score
10/10
banloaddiscoverydownloaderdropperevasionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      Trojan_Remover_V6.9.6.exe

    • Size

      20.9MB

    • MD5

      b99984ad78f818d34c5ed599d312a2e1

    • SHA1

      893ffbaf835653ed197fccb8c756ad21a679a081

    • SHA256

      f7f8880582210c104511885f52112ef6bb8977775dd3e3343c62e6d9e196f3e8

    • SHA512

      ff293cf4757232a786e17e0bf825bed6325e6b713477381ad849379d3bb7d18ef1b33ffaefda766f1296809f15092a6bc2970cb5d860dbf23ad8c731814ab271

    • SSDEEP

      393216:dYm0BJS9+7GOq1GHZhOZjHlHAoYJ/fpQwa83E0vZkLB2oXJp5hT3MaVm+y:+M+t+IbOZHlgB/fpWmEwZkLMw38x+y

    Score
    10/10
    banloaddiscoverydownloaderdropperevasionpersistenceprivilege_escalationtrojan

    • Banload

      Banload variants download malicious files, then install and execute the files.

      trojandropperdownloaderbanload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks