banload | 1e8928ea6af4934b80ca64777043889cdc090b71de7142ade558b82dabf32c14 | Triage

Sharing

General

Target

1e8928ea6af4934b80ca64777043889cdc090b71de7142ade558b82dabf32c14.exe
Size

110KB
Sample

241231-pb241ssjgr
MD5

7235214a4ce20d8de48cf433d90ae317
SHA1

824dac2ac953294e232b428c93da8788f0015ffb
SHA256

1e8928ea6af4934b80ca64777043889cdc090b71de7142ade558b82dabf32c14
SHA512

556202929691aa635642fe7b0dd00db81438a55dc57a9796bfc3c415b70c7bbfa0d93fda2a1d5046ebb758d23eff15438581651fb263734106e7c0e3609083e9
SSDEEP

1536:BLXB65939tY6HBg4sXJ1UviBhkohVKJjFhaLeT99+eLnV7UviBhkohVKJjFhvOcP:BLk395hYXJ1UvUWXsP2npUvUWX81U

Score

10^/10

banload discovery downloader dropper evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  1e8928ea6af4934b80ca64777043889cdc090b71de7142ade558b82dabf32c14.exe
- Size
  
  110KB
- MD5
  
  7235214a4ce20d8de48cf433d90ae317
- SHA1
  
  824dac2ac953294e232b428c93da8788f0015ffb
- SHA256
  
  1e8928ea6af4934b80ca64777043889cdc090b71de7142ade558b82dabf32c14
- SHA512
  
  556202929691aa635642fe7b0dd00db81438a55dc57a9796bfc3c415b70c7bbfa0d93fda2a1d5046ebb758d23eff15438581651fb263734106e7c0e3609083e9
- SSDEEP
  
  1536:BLXB65939tY6HBg4sXJ1UviBhkohVKJjFhaLeT99+eLnV7UviBhkohVKJjFhvOcP:BLk395hYXJ1UvUWXsP2npUvUWX81U
Score

10^/10

discovery banload downloader dropper evasion spyware stealer trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Banload family
  banload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

banloaddiscoverydownloaderdropperevasionspywarestealertrojan