eb9e193ab1f6a928f975b75a66eaff7447c6d69e2695f1b39fc8a0c71fba712d

General

Target
Belial.exe
Size 89KB
Sample260616-2b72gsfs4l
SHA256 eb9e193ab1f6a928f975b75a66eaff7447c6d69e2695f1b39fc8a0c71fba712d
MD5 fbfa0575a23c73404dc19289cdaab8c0
SHA1 3ada33dd11788afc7692e774e103e801b6157f95
SHA512 debd0fc7f243e07b8fb4fbacc012713bd2f9755ea04868b372ceb639e55d83b14d7f6233819bc15ac8f606681e3420f718ab0f5a757bd0e11206360f27e04c80
SSDEEP 1536:q4vnzGWxJj9RskhhJljHOPcUY599zWHqd5+flzA5CCT3n02UVvJWkOuW:TveHzzdC4DPO1
TLSH
T14593074A5722DBFBD9008B35C4B70219FB35D1020B825EDB6D5541307F93BE98EA7B89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Belial.exe
- Size 89KB
- SHA256 eb9e193ab1f6a928f975b75a66eaff7447c6d69e2695f1b39fc8a0c71fba712d
- MD5 fbfa0575a23c73404dc19289cdaab8c0
- SHA1 3ada33dd11788afc7692e774e103e801b6157f95
- SHA512 debd0fc7f243e07b8fb4fbacc012713bd2f9755ea04868b372ceb639e55d83b14d7f6233819bc15ac8f606681e3420f718ab0f5a757bd0e11206360f27e04c80
- SSDEEP 1536:q4vnzGWxJj9RskhhJljHOPcUY599zWHqd5+flzA5CCT3n02UVvJWkOuW:TveHzzdC4DPO1
- TLSH
  T14593074A5722DBFBD9008B35C4B70219FB35D1020B825EDB6D5541307F93BE98EA7B89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit discovery exploit persistence spyware stealer
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Possible privilege escalation attempt
  exploit
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral1 behavioral2