Overview

overview

10

Static

static

3

2025-04-09...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-09_fb2b269302236eb4b3960dc0d570a31d_amadey_hawkeye_smoke-loader

  • Size

    5.9MB

  • Sample

    250409-j7lh9avlv4

  • MD5

    fb2b269302236eb4b3960dc0d570a31d

  • SHA1

    42912f12f4c5fb83026204a663aea5051b1ad0da

  • SHA256

    3e87857f9eda3416070db632b47961892bfc4ec4a3eeed3749a7ec493851ea58

  • SHA512

    352cf339c580f1c54c88ad7237852260045e1de1526a23178bf6ba637a89e1f011b7ee182aa206863793768131ee5acbbe8cb6aacdabc9adf1625714fef771b8

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEv++q5MOApXmtF8Rfnrlr:RFQWEPnPBnEQi

Score
10/10
banloaddefense_evasiondiscoverydownloaderdropperransomwaretrojan

Malware Config

Targets

    • Target

      2025-04-09_fb2b269302236eb4b3960dc0d570a31d_amadey_hawkeye_smoke-loader

    • Size

      5.9MB

    • MD5

      fb2b269302236eb4b3960dc0d570a31d

    • SHA1

      42912f12f4c5fb83026204a663aea5051b1ad0da

    • SHA256

      3e87857f9eda3416070db632b47961892bfc4ec4a3eeed3749a7ec493851ea58

    • SHA512

      352cf339c580f1c54c88ad7237852260045e1de1526a23178bf6ba637a89e1f011b7ee182aa206863793768131ee5acbbe8cb6aacdabc9adf1625714fef771b8

    • SSDEEP

      98304:RF8QUitE4iLqaPWGnEv++q5MOApXmtF8Rfnrlr:RFQWEPnPBnEQi

    Score
    10/10
    banloaddefense_evasiondiscoverydownloaderdropperransomwaretrojan

    • Banload

      Banload variants download malicious files, then install and execute the files.

      trojandropperdownloaderbanload

    • Banload family

      banload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Renames multiple (339) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks