Overview

overview

10

Static

static

10

ea72a74a92...58.exe

windows7-x64

10

ea72a74a92...58.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ea72a74a928804c6dccd3fcf50359858

  • Size

    1.5MB

  • Sample

    220908-yg2vwaffe4

  • MD5

    ea72a74a928804c6dccd3fcf50359858

  • SHA1

    0ac9576ce126a92318ab2f24da228c2c59cf1bbb

  • SHA256

    32cc32b8cb89d63f0da7b7202cf2613c909d79b38148d2e5c3da3e3b28aecc98

  • SHA512

    f787e57fa78a97c8679ad591fe7d326ab4027360aa654fcd54da63f5678801cf0de138550049fc6c9eb8856058b2f5cd8c60dd6fe4ab4653adc3f945ba38f60c

  • SSDEEP

    6144:EuYlLLblhnZWjUu2seE2fgM1c90tytvSDgIYnluH6fhcwazfgD:EpPPnZWjMREkgMI8QvggIGQaZ7ajgD

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      ea72a74a928804c6dccd3fcf50359858

    • Size

      1.5MB

    • MD5

      ea72a74a928804c6dccd3fcf50359858

    • SHA1

      0ac9576ce126a92318ab2f24da228c2c59cf1bbb

    • SHA256

      32cc32b8cb89d63f0da7b7202cf2613c909d79b38148d2e5c3da3e3b28aecc98

    • SHA512

      f787e57fa78a97c8679ad591fe7d326ab4027360aa654fcd54da63f5678801cf0de138550049fc6c9eb8856058b2f5cd8c60dd6fe4ab4653adc3f945ba38f60c

    • SSDEEP

      6144:EuYlLLblhnZWjUu2seE2fgM1c90tytvSDgIYnluH6fhcwazfgD:EpPPnZWjMREkgMI8QvggIGQaZ7ajgD

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks