Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7b26fe68df2dc9d696d8ee18e20557f7fbcdac24d3df23a04802cf30bbf8e267

  • Size

    78KB

  • Sample

    221107-vlcj1abcfm

  • MD5

    071189617168638e8466d57caca9fa8c

  • SHA1

    7310789d4063bd26719e16f9acc0cdd93347675d

  • SHA256

    7b26fe68df2dc9d696d8ee18e20557f7fbcdac24d3df23a04802cf30bbf8e267

  • SHA512

    1b15cd5989539a8440c6121d9ee271abfd20ac5292d4bed1f37ccd648dd60042423587ab04909ef7f3f419c9edf9eee4a8cae44e206cf930b35cc72f45db3123

  • SSDEEP

    1536:mZye8psDhdvoYIflDvf+RBe50UE8Feu6JsuDTpU0WyT:+vdvYlDvWRBeiUDTBwVU0H

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      7b26fe68df2dc9d696d8ee18e20557f7fbcdac24d3df23a04802cf30bbf8e267

    • Size

      78KB

    • MD5

      071189617168638e8466d57caca9fa8c

    • SHA1

      7310789d4063bd26719e16f9acc0cdd93347675d

    • SHA256

      7b26fe68df2dc9d696d8ee18e20557f7fbcdac24d3df23a04802cf30bbf8e267

    • SHA512

      1b15cd5989539a8440c6121d9ee271abfd20ac5292d4bed1f37ccd648dd60042423587ab04909ef7f3f419c9edf9eee4a8cae44e206cf930b35cc72f45db3123

    • SSDEEP

      1536:mZye8psDhdvoYIflDvf+RBe50UE8Feu6JsuDTpU0WyT:+vdvYlDvWRBeiUDTBwVU0H

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks