banload | bfaef2e37334a7f90734e0c2a9e9a515cc57ce6fd64ab9e87355241974f30ba0 | Triage

Sharing

General

Target

bfaef2e37334a7f90734e0c2a9e9a515cc57ce6fd64ab9e87355241974f30ba0
Size

3.0MB
Sample

250109-aj22nazjgs
MD5

6419dc2751f212d3989a0131bf04ab1b
SHA1

5b9f6db9d843f118ae8ce5ed067f90d6079f358a
SHA256

bfaef2e37334a7f90734e0c2a9e9a515cc57ce6fd64ab9e87355241974f30ba0
SHA512

8af8611276fe045fd35f4511d7ded67b5d73ea21f2a4647b9306545f41187042feda46f69a7ed30795a901000c1f6714c46bd8f2d2860d9d584274385431bc88
SSDEEP

49152:EpbRm4GPK/MI2STfnj2Qb169tOotoVDn99c1/0VXHhf0dWma2sx05tE:Y1GS/32Z3OiuDnu0VXHhBmAxStE

Score

10^/10

banload downloader dropper persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  bfaef2e37334a7f90734e0c2a9e9a515cc57ce6fd64ab9e87355241974f30ba0
- Size
  
  3.0MB
- MD5
  
  6419dc2751f212d3989a0131bf04ab1b
- SHA1
  
  5b9f6db9d843f118ae8ce5ed067f90d6079f358a
- SHA256
  
  bfaef2e37334a7f90734e0c2a9e9a515cc57ce6fd64ab9e87355241974f30ba0
- SHA512
  
  8af8611276fe045fd35f4511d7ded67b5d73ea21f2a4647b9306545f41187042feda46f69a7ed30795a901000c1f6714c46bd8f2d2860d9d584274385431bc88
- SSDEEP
  
  49152:EpbRm4GPK/MI2STfnj2Qb169tOotoVDn99c1/0VXHhf0dWma2sx05tE:Y1GS/32Z3OiuDnu0VXHhBmAxStE
Score

10^/10

banload downloader dropper persistence privilege_escalation trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Banload family
  banload
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

banloaddownloaderdropperpersistenceprivilege_escalationtrojan

behavioral2

banloaddownloaderdropperpersistenceprivilege_escalationtrojan