banload | 318704f2842db93eeec2ec6a4803a1d03f16ff4303131b935dd2c3270afa56d5 | Triage

Sharing

General

Target

318704f2842db93eeec2ec6a4803a1d03f16ff4303131b935dd2c3270afa56d5
Size

2.9MB
Sample

241202-xqvbqaxngy
MD5

a5455d571dfe2fb417ae9b31441627a6
SHA1

37960f0f3365387995493ea9ac8588480880fd50
SHA256

318704f2842db93eeec2ec6a4803a1d03f16ff4303131b935dd2c3270afa56d5
SHA512

bc60ab8b0afee20e9d9b67f340a6b85a717d3241517340a63a8211e3140f45adfc1a6aec987e06284babb2e241c0ddccea477c502beb7b32c9a9d96ea116f38c
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVWiK2XARrP/WH5g:RF8QUitE4iLqaPWGnEv6WHm

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Targets

- Target
  
  318704f2842db93eeec2ec6a4803a1d03f16ff4303131b935dd2c3270afa56d5
- Size
  
  2.9MB
- MD5
  
  a5455d571dfe2fb417ae9b31441627a6
- SHA1
  
  37960f0f3365387995493ea9ac8588480880fd50
- SHA256
  
  318704f2842db93eeec2ec6a4803a1d03f16ff4303131b935dd2c3270afa56d5
- SHA512
  
  bc60ab8b0afee20e9d9b67f340a6b85a717d3241517340a63a8211e3140f45adfc1a6aec987e06284babb2e241c0ddccea477c502beb7b32c9a9d96ea116f38c
- SSDEEP
  
  49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVWiK2XARrP/WH5g:RF8QUitE4iLqaPWGnEv6WHm
Score

10^/10

banload discovery downloader dropper evasion ransomware trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Banload family
  banload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Renames multiple (196) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

banloaddiscoverydownloaderdropperevasionransomwaretrojan

behavioral2

banloaddiscoverydownloaderdropperevasionransomwaretrojan