banload | f15c44f5e0edbc24d48862f40412298c4858d2884a91b66bf258466a744873b6 | Triage

Sharing

General

Target

JaffaCakes118_db4c18758053b241f71615a11d1f8561
Size

19.0MB
Sample

250210-peah6sslgz
MD5

db4c18758053b241f71615a11d1f8561
SHA1

b0ee5976539fc92258c63de0cda7307e94365e72
SHA256

f15c44f5e0edbc24d48862f40412298c4858d2884a91b66bf258466a744873b6
SHA512

70729e974a61992386779446f129326e6e6194c15fdec34e58c3cb4df5e194e0c55e997a345fe9e6a77356148e486e8c09c7c0fd03898ffcae7c87862e22eafa
SSDEEP

393216:Z86xyOctdzkTiouNYRG7DHn3btHKiSkWTpHMoVYshdOMKQEv8W:Z8mxcTkTiocIwCpHMwYDPvL

Score

10^/10

banload discovery downloader dropper trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_db4c18758053b241f71615a11d1f8561
- Size
  
  19.0MB
- MD5
  
  db4c18758053b241f71615a11d1f8561
- SHA1
  
  b0ee5976539fc92258c63de0cda7307e94365e72
- SHA256
  
  f15c44f5e0edbc24d48862f40412298c4858d2884a91b66bf258466a744873b6
- SHA512
  
  70729e974a61992386779446f129326e6e6194c15fdec34e58c3cb4df5e194e0c55e997a345fe9e6a77356148e486e8c09c7c0fd03898ffcae7c87862e22eafa
- SSDEEP
  
  393216:Z86xyOctdzkTiouNYRG7DHn3btHKiSkWTpHMoVYshdOMKQEv8W:Z8mxcTkTiocIwCpHMwYDPvL
Score

8^/10

discovery
- Downloads MZ/PE file
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  9384f4007c492d4fa040924f31c00166
- SHA1
  
  aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA256
  
  60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- SHA512
  
  68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP
  
  48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StartMenu.dll
- Size
  
  7KB
- MD5
  
  a4173b381625f9f12aadb4e1cdaefdb8
- SHA1
  
  cf1680c2bc970d5675adbf5e89292a97e6724713
- SHA256
  
  7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
- SHA512
  
  fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
- SSDEEP
  
  96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/UserInfo.dll
- Size
  
  4KB
- MD5
  
  7579ade7ae1747a31960a228ce02e666
- SHA1
  
  8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA256
  
  564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- SHA512
  
  a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  c10e04dd4ad4277d5adc951bb331c777
- SHA1
  
  b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA256
  
  e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- SHA512
  
  853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP
  
  96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/nsisdk.dll
- Size
  
  28KB
- MD5
  
  deb4db1ff057906c96e6f949e5862508
- SHA1
  
  495c8703a43826df4ac8de20efbbeebcd5263c13
- SHA256
  
  fc7ab6a88fe725de19804931655f6c61d4072495ebb1ddb73ddfac0dca7d0d1e
- SHA512
  
  b37348d57d774b66afd192c0d2cb95c261ea4b75874190fd4809249cfea5500eaa0d9ad09af2afe83904b29539796440663d6e916362acf9c21894809ea32d46
- SSDEEP
  
  384:Snw9iuDIPi/ij7m+1I+rqZTYmZLb/BLbyrDzbgVIdHk0iVqeyf/zBx+HUTRv:Sw1DSi/ija+1IHZzOzbgV+E0teyjG0
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral13 behavioral14
- Target
  
  AdsScheduler.exe
- Size
  
  3.9MB
- MD5
  
  90e60a7c4860be9ea980456af286e5e2
- SHA1
  
  de5e724c3bf3667bff76ce88c2b9fbcc163456ac
- SHA256
  
  94a8514d5e77de67782a40a091b1c0739779e21fdfcf0cf60961604647bf2e17
- SHA512
  
  6e4690b278c71971e8056d64a2cb78bbea9bc23e0fa2e01bb6337d2ca61ca38bc33f036da58f2edc826febb06029ffb14e3ae20724dbf7e5e5f213473bc2c855
- SSDEEP
  
  98304:8Zm187PS2IxuNBvVUFJH1Cr08q67uc1UfLn:em0S2mu7vVUFJH1J67uc
Score

10^/10

banload discovery downloader dropper trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Banload family
  banload
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral15 behavioral16
- Target
  
  Base.exe
- Size
  
  2.1MB
- MD5
  
  a8047e04ac05a799af9e555e60f30f35
- SHA1
  
  b0e7c2b8f0cb0dc576a1f54d82c31f4311e3c3e0
- SHA256
  
  7c2d568ce2d9d0de14ed9623f01d2346218dd917edb9c58b9e044238104b668f
- SHA512
  
  43ed42b1ff266fa8bc591519aed7d72dbbe7543b807858834092e7175991ead5a976fd42ebee8a91fd62a1061acd76f2f58d7b10c6ccf22ae767dea5e6fc4203
- SSDEEP
  
  24576:qwc4IHNdRmoFXbrKmgB76DhxlrIYSRzBLSw8ELSV5zjatQoEe00ykzcubKHnXzU:c587m/+RzlSw8g8zjaWexvh2A
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral17 behavioral18
- Target
  
  Lang/Ar/help.chm
- Size
  
  2.4MB
- MD5
  
  81d7a3020a883a001e939439f92ceb1b
- SHA1
  
  15233d9410b71f0194768c887aa670fbf9f82074
- SHA256
  
  96e1d5840721f2cbc550398200700a7a65a4da7447f5972e5ff3eddb606ddf5a
- SHA512
  
  6825abe057fcdd98333859faad9c9c564822e33dbb986ce23cae420109e7d691a4c6252cb1c4600af44a517e7f10799e6be0046bc7fd68715fca35fe1b83cf6f
- SSDEEP
  
  49152:MGyQ7DUqTPYtIC+5MN268D2MfW9ERlK0NfisauWFk0Nt54vu3bnw:MGZHPPYttOMv8SMOExisYjyu3Tw
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral19 behavioral20
- Target
  
  Lang/Bg/help.chm
- Size
  
  2.4MB
- MD5
  
  81d7a3020a883a001e939439f92ceb1b
- SHA1
  
  15233d9410b71f0194768c887aa670fbf9f82074
- SHA256
  
  96e1d5840721f2cbc550398200700a7a65a4da7447f5972e5ff3eddb606ddf5a
- SHA512
  
  6825abe057fcdd98333859faad9c9c564822e33dbb986ce23cae420109e7d691a4c6252cb1c4600af44a517e7f10799e6be0046bc7fd68715fca35fe1b83cf6f
- SSDEEP
  
  49152:MGyQ7DUqTPYtIC+5MN268D2MfW9ERlK0NfisauWFk0Nt54vu3bnw:MGZHPPYttOMv8SMOExisYjyu3Tw
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral21 behavioral22
- Target
  
  Lang/Da/help.chm
- Size
  
  2.4MB
- MD5
  
  81d7a3020a883a001e939439f92ceb1b
- SHA1
  
  15233d9410b71f0194768c887aa670fbf9f82074
- SHA256
  
  96e1d5840721f2cbc550398200700a7a65a4da7447f5972e5ff3eddb606ddf5a
- SHA512
  
  6825abe057fcdd98333859faad9c9c564822e33dbb986ce23cae420109e7d691a4c6252cb1c4600af44a517e7f10799e6be0046bc7fd68715fca35fe1b83cf6f
- SSDEEP
  
  49152:MGyQ7DUqTPYtIC+5MN268D2MfW9ERlK0NfisauWFk0Nt54vu3bnw:MGZHPPYttOMv8SMOExisYjyu3Tw
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral23 behavioral24
- Target
  
  Lang/De/help.chm
- Size
  
  2.4MB
- MD5
  
  81d7a3020a883a001e939439f92ceb1b
- SHA1
  
  15233d9410b71f0194768c887aa670fbf9f82074
- SHA256
  
  96e1d5840721f2cbc550398200700a7a65a4da7447f5972e5ff3eddb606ddf5a
- SHA512
  
  6825abe057fcdd98333859faad9c9c564822e33dbb986ce23cae420109e7d691a4c6252cb1c4600af44a517e7f10799e6be0046bc7fd68715fca35fe1b83cf6f
- SSDEEP
  
  49152:MGyQ7DUqTPYtIC+5MN268D2MfW9ERlK0NfisauWFk0Nt54vu3bnw:MGZHPPYttOMv8SMOExisYjyu3Tw
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral25 behavioral26
- Target
  
  Lang/En/help.chm
- Size
  
  2.4MB
- MD5
  
  81d7a3020a883a001e939439f92ceb1b
- SHA1
  
  15233d9410b71f0194768c887aa670fbf9f82074
- SHA256
  
  96e1d5840721f2cbc550398200700a7a65a4da7447f5972e5ff3eddb606ddf5a
- SHA512
  
  6825abe057fcdd98333859faad9c9c564822e33dbb986ce23cae420109e7d691a4c6252cb1c4600af44a517e7f10799e6be0046bc7fd68715fca35fe1b83cf6f
- SSDEEP
  
  49152:MGyQ7DUqTPYtIC+5MN268D2MfW9ERlK0NfisauWFk0Nt54vu3bnw:MGZHPPYttOMv8SMOExisYjyu3Tw
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral27 behavioral28
- Target
  
  Lang/Es/help.chm
- Size
  
  2.4MB
- MD5
  
  81d7a3020a883a001e939439f92ceb1b
- SHA1
  
  15233d9410b71f0194768c887aa670fbf9f82074
- SHA256
  
  96e1d5840721f2cbc550398200700a7a65a4da7447f5972e5ff3eddb606ddf5a
- SHA512
  
  6825abe057fcdd98333859faad9c9c564822e33dbb986ce23cae420109e7d691a4c6252cb1c4600af44a517e7f10799e6be0046bc7fd68715fca35fe1b83cf6f
- SSDEEP
  
  49152:MGyQ7DUqTPYtIC+5MN268D2MfW9ERlK0NfisauWFk0Nt54vu3bnw:MGZHPPYttOMv8SMOExisYjyu3Tw
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral29 behavioral30
- Target
  
  Lang/Fr/help.chm
- Size
  
  2.4MB
- MD5
  
  81d7a3020a883a001e939439f92ceb1b
- SHA1
  
  15233d9410b71f0194768c887aa670fbf9f82074
- SHA256
  
  96e1d5840721f2cbc550398200700a7a65a4da7447f5972e5ff3eddb606ddf5a
- SHA512
  
  6825abe057fcdd98333859faad9c9c564822e33dbb986ce23cae420109e7d691a4c6252cb1c4600af44a517e7f10799e6be0046bc7fd68715fca35fe1b83cf6f
- SSDEEP
  
  49152:MGyQ7DUqTPYtIC+5MN268D2MfW9ERlK0NfisauWFk0Nt54vu3bnw:MGZHPPYttOMv8SMOExisYjyu3Tw
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

banloaddiscoverydownloaderdroppertrojan

behavioral16

banloaddiscoverydownloaderdroppertrojan

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32