Overview

overview

10

Static

static

f62bee3a46...d8.exe

windows7-x64

10

f62bee3a46...d8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f62bee3a4652eb371532916568c93e082a0d3e483b742ca071b912fdb59c05d8

  • Size

    26KB

  • Sample

    221106-28rqrsfdb3

  • MD5

    06fd302e4905134dc49c847c86d391a3

  • SHA1

    8535596d6e8e3eef756fd94170a06926e2a0457b

  • SHA256

    f62bee3a4652eb371532916568c93e082a0d3e483b742ca071b912fdb59c05d8

  • SHA512

    8d05a38db6afab6fdac683617c83e2e09b7f001a786d7fb8cf903a82ab9c91dac34e6b17244e257a2324f3e07b871c1f18ddad99968500b7306ddc564d33d1c4

  • SSDEEP

    768:ZDdsnPYlDdtwSZ79FvJ4wGQF2AbxHX0h42nzMm3:ZDhRsO73v2wTFnb5OnzMm3

Score
10/10
blackmoonbankerpersistencetrojan

Malware Config

Targets

    • Target

      f62bee3a4652eb371532916568c93e082a0d3e483b742ca071b912fdb59c05d8

    • Size

      26KB

    • MD5

      06fd302e4905134dc49c847c86d391a3

    • SHA1

      8535596d6e8e3eef756fd94170a06926e2a0457b

    • SHA256

      f62bee3a4652eb371532916568c93e082a0d3e483b742ca071b912fdb59c05d8

    • SHA512

      8d05a38db6afab6fdac683617c83e2e09b7f001a786d7fb8cf903a82ab9c91dac34e6b17244e257a2324f3e07b871c1f18ddad99968500b7306ddc564d33d1c4

    • SSDEEP

      768:ZDdsnPYlDdtwSZ79FvJ4wGQF2AbxHX0h42nzMm3:ZDhRsO73v2wTFnb5OnzMm3

    Score
    10/10
    blackmoonbankerpersistencetrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks