banload | feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07 | Triage

Sharing

General

Target

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
Size

3.0MB
Sample

241203-19r79axldv
MD5

f66bd304ccdd3a52ab75ac80ceffbd50
SHA1

357c988948b13361b7236212ebdc0dbdab6caf30
SHA256

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07
SHA512

47d02ee8a713491f6f945557e2fb012957a107f788732f9eb1737cd7653ff24b47d7c32f737da0d2b46963adcbb9e6aeecb22fa7435c7eef16bb890d52e0f931
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV47RIgiBud:RF8QUitE4iLqaPWGnEvK7RR

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Targets

- Target
  
  feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
- Size
  
  3.0MB
- MD5
  
  f66bd304ccdd3a52ab75ac80ceffbd50
- SHA1
  
  357c988948b13361b7236212ebdc0dbdab6caf30
- SHA256
  
  feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07
- SHA512
  
  47d02ee8a713491f6f945557e2fb012957a107f788732f9eb1737cd7653ff24b47d7c32f737da0d2b46963adcbb9e6aeecb22fa7435c7eef16bb890d52e0f931
- SSDEEP
  
  49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV47RIgiBud:RF8QUitE4iLqaPWGnEvK7RR
Score

10^/10

banload discovery downloader dropper evasion ransomware trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Banload family
  banload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Renames multiple (211) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

banloaddiscoverydownloaderdropperevasionransomwaretrojan

behavioral2

banloaddiscoverydownloaderdropperevasionransomwaretrojan