banload | 99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b | Triage

Sharing

General

Target

99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b
Size

4.8MB
Sample

241227-yk2z2symcy
MD5

ae814e0b9947b36ae1fc82e5ed2648ed
SHA1

d6fbfcd6b11d7a571f8e4d3a360d8f5001c1901c
SHA256

99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b
SHA512

5fab9b9434479d80d2a8c8172c7d579c6bd070c75679d2f2d605c95e31496b3aba58bfca82c7d0b35189e3ff67dfb6d8c4b93660ca4f5d80519592575510d6f3
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVPYOKQrgCGMxu3fFne4j4ZXums:RF8QUitE4iLqaPWGnEv+OKQr8MAvFrd

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Targets

- Target
  
  99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b
- Size
  
  4.8MB
- MD5
  
  ae814e0b9947b36ae1fc82e5ed2648ed
- SHA1
  
  d6fbfcd6b11d7a571f8e4d3a360d8f5001c1901c
- SHA256
  
  99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b
- SHA512
  
  5fab9b9434479d80d2a8c8172c7d579c6bd070c75679d2f2d605c95e31496b3aba58bfca82c7d0b35189e3ff67dfb6d8c4b93660ca4f5d80519592575510d6f3
- SSDEEP
  
  49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVPYOKQrgCGMxu3fFne4j4ZXums:RF8QUitE4iLqaPWGnEv+OKQr8MAvFrd
Score

10^/10

banload discovery downloader dropper evasion ransomware trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Banload family
  banload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Renames multiple (142) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

banloaddiscoverydownloaderdropperevasionransomwaretrojan

behavioral2

banloaddiscoverydownloaderdropperevasionransomwaretrojan