banload | 55459cfc161cebc672eabbf0bfd8d406edc4aa5ae0a070dbb73749c278c8ae64 | Triage

Submit
Reports

Overview

overview

Static

static

3

55459cfc16...64.exe

windows10-2004-x64

Sharing

General

Target

55459cfc161cebc672eabbf0bfd8d406edc4aa5ae0a070dbb73749c278c8ae64
Size

3.0MB
Sample

250412-tv3xwayjt6
MD5

9dfb2cc63a4f7bfe344c992d7cfaedf0
SHA1

fdbfb02be0624e25c1b55d6b715558fa317f5c2f
SHA256

55459cfc161cebc672eabbf0bfd8d406edc4aa5ae0a070dbb73749c278c8ae64
SHA512

5ca4547e2dc6c4fa17508f759f781bd37eef0eabd81d47085c0a4eb9957f48a096de1a553fce206fec961547cd1672d22112a1264761cb1a9489c57f36cb2914
SSDEEP

49152:OpbRm4GPK/Mv2STfnXR8lnz48kaMoVDn99c1/0VXfEmX28xO5tL:O1GS/IRwfkFuDnu0VXsm7xQtL

Score

10^/10

banload downloader dropper persistence privilege_escalation trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

55459cfc161cebc672eabbf0bfd8d406edc4aa5ae0a070dbb73749c278c8ae64.exe

Resource

win10v2004-20250410-en

banload downloader dropper persistence privilege_escalation trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  55459cfc161cebc672eabbf0bfd8d406edc4aa5ae0a070dbb73749c278c8ae64
- Size
  
  3.0MB
- MD5
  
  9dfb2cc63a4f7bfe344c992d7cfaedf0
- SHA1
  
  fdbfb02be0624e25c1b55d6b715558fa317f5c2f
- SHA256
  
  55459cfc161cebc672eabbf0bfd8d406edc4aa5ae0a070dbb73749c278c8ae64
- SHA512
  
  5ca4547e2dc6c4fa17508f759f781bd37eef0eabd81d47085c0a4eb9957f48a096de1a553fce206fec961547cd1672d22112a1264761cb1a9489c57f36cb2914
- SSDEEP
  
  49152:OpbRm4GPK/Mv2STfnXR8lnz48kaMoVDn99c1/0VXfEmX28xO5tL:O1GS/IRwfkFuDnu0VXsm7xQtL
Score

10^/10

banload downloader dropper persistence privilege_escalation trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Banload family
  banload
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

banloaddownloaderdropperpersistenceprivilege_escalationtrojan

© 2018-2025

Terms | Privacy