General
-
Target
53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe
-
Size
6.1MB
-
Sample
241205-n9axratmes
-
MD5
5a84f364482853c29047580452aefb80
-
SHA1
64ae21b3bf0f20bd348182b6d256dddeefcb374f
-
SHA256
53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315
-
SHA512
1483f579fd50619398d746f1aaa9a87004f143fdf635c319223db23d7fb2bcf7d3fe22f4b9331ccb2068ae605ae60146086dfa8020c4c131052f2bc72a0fda3d
-
SSDEEP
98304:t0oOwohXs3/bXZLM89E2l7642vkJvQnV1ydJTTjAOooSjMWhso9ZPQEGhLljcgmf:trD9Jl6s4V4dJbAKSlxZkNljcgmRdP
Malware Config
Targets
-
-
Target
53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe
-
Size
6.1MB
-
MD5
5a84f364482853c29047580452aefb80
-
SHA1
64ae21b3bf0f20bd348182b6d256dddeefcb374f
-
SHA256
53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315
-
SHA512
1483f579fd50619398d746f1aaa9a87004f143fdf635c319223db23d7fb2bcf7d3fe22f4b9331ccb2068ae605ae60146086dfa8020c4c131052f2bc72a0fda3d
-
SSDEEP
98304:t0oOwohXs3/bXZLM89E2l7642vkJvQnV1ydJTTjAOooSjMWhso9ZPQEGhLljcgmf:trD9Jl6s4V4dJbAKSlxZkNljcgmRdP
Score10/10-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload
-
Drops file in Drivers directory
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-