banload | ab700a925751c21710ddf713c7c09e61a0822029db8d2a70b063dda6bc457e34 | Triage

Sharing

General

Target

JaffaCakes118_9dfd283c4620d082ee28d02f872e3741
Size

3.6MB
Sample

250407-fz2nqasm15
MD5

9dfd283c4620d082ee28d02f872e3741
SHA1

c9305d0ef5bc095d8befb957e3c710986de25852
SHA256

ab700a925751c21710ddf713c7c09e61a0822029db8d2a70b063dda6bc457e34
SHA512

abbd37a470315bea56aa43631cc1d07667579a35b122a67f339a1bc40dcace208d00fc29c97c471dfff66dc02bd9e67df71ad2086584fd7bd2ccbea2ebb7652d
SSDEEP

49152:9eeiQPIcX6TsOgeqm4ihDYLxVp92r7z/p3t3qLw8l2/Pic:9egOF4iVaN9GXx359kqKc

Score

10^/10

banload defense_evasion discovery downloader dropper execution persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_9dfd283c4620d082ee28d02f872e3741
- Size
  
  3.6MB
- MD5
  
  9dfd283c4620d082ee28d02f872e3741
- SHA1
  
  c9305d0ef5bc095d8befb957e3c710986de25852
- SHA256
  
  ab700a925751c21710ddf713c7c09e61a0822029db8d2a70b063dda6bc457e34
- SHA512
  
  abbd37a470315bea56aa43631cc1d07667579a35b122a67f339a1bc40dcace208d00fc29c97c471dfff66dc02bd9e67df71ad2086584fd7bd2ccbea2ebb7652d
- SSDEEP
  
  49152:9eeiQPIcX6TsOgeqm4ihDYLxVp92r7z/p3t3qLw8l2/Pic:9egOF4iVaN9GXx359kqKc
Score

10^/10

banload defense_evasion discovery downloader dropper execution persistence privilege_escalation trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Banload family
  banload
- UAC bypass
  defense_evasion trojan
- Modifies Windows Firewall
  defense_evasion
- Stops running service(s)
  defense_evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Network Share Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

banloaddefense_evasiondiscoverydownloaderdropperexecutionpersistenceprivilege_escalationtrojan