General
-
Target
b8dc0e49c531115b4aab14ea0700160c1d6f63f9dcaf8ad1662254edb7d1bbd4
-
Size
28KB
-
Sample
221015-1vfkxagcfn
-
MD5
1026b5b39cb679fab4cf8b88b8bdbcbc
-
SHA1
c9243ddb9ec1e1348cb1999bf763fe47af1af734
-
SHA256
b8dc0e49c531115b4aab14ea0700160c1d6f63f9dcaf8ad1662254edb7d1bbd4
-
SHA512
420e7d9e14c48c2efef3534869be6053a3759eb39937b46d917accd32e3ee2dfa3d23d79ebc32e32616ed654e7f8344211aaa4696f3dac858e2642402d8d5991
-
SSDEEP
768:S6fyOBIBGBCBtB2BfBmBoBvBaBqBMBoBJBDBoBCeBDPu4wHc57Fac+KX3:Lxp4wE7F9
Malware Config
Targets
-
-
Target
b8dc0e49c531115b4aab14ea0700160c1d6f63f9dcaf8ad1662254edb7d1bbd4
-
Size
28KB
-
MD5
1026b5b39cb679fab4cf8b88b8bdbcbc
-
SHA1
c9243ddb9ec1e1348cb1999bf763fe47af1af734
-
SHA256
b8dc0e49c531115b4aab14ea0700160c1d6f63f9dcaf8ad1662254edb7d1bbd4
-
SHA512
420e7d9e14c48c2efef3534869be6053a3759eb39937b46d917accd32e3ee2dfa3d23d79ebc32e32616ed654e7f8344211aaa4696f3dac858e2642402d8d5991
-
SSDEEP
768:S6fyOBIBGBCBtB2BfBmBoBvBaBqBMBoBJBDBoBCeBDPu4wHc57Fac+KX3:Lxp4wE7F9
Score10/10-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-