Overview

overview

10

Static

static

e68f08a021...c4.exe

windows7-x64

10

e68f08a021...c4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e68f08a021c90809c6075a9385a2b80cb025877ffa1a09b0b6c122c3d726e7c4

  • Size

    68KB

  • Sample

    221123-p2xl8ach25

  • MD5

    efe656f08bdd12531ee5da0f6e775912

  • SHA1

    362e8920e4301fa6d8cf12cbceb75eb06b6635bc

  • SHA256

    e68f08a021c90809c6075a9385a2b80cb025877ffa1a09b0b6c122c3d726e7c4

  • SHA512

    23328ca70828e9977a06f6525d5beda6c5a9137778e4ded83307fcc40c9e1006b00a6e4315fdadb1629873e3a3ee94f513b3af0719ad9d7b04897e4299b1fdf3

  • SSDEEP

    1536:HYL53ZzLd2QZO6wug6yohaL+obgGlvkW0GJ1d:HYV3Rd2QZ5foSGlx0u/

Score
10/10
blackmoonbankerpersistencetrojan

Malware Config

Targets

    • Target

      e68f08a021c90809c6075a9385a2b80cb025877ffa1a09b0b6c122c3d726e7c4

    • Size

      68KB

    • MD5

      efe656f08bdd12531ee5da0f6e775912

    • SHA1

      362e8920e4301fa6d8cf12cbceb75eb06b6635bc

    • SHA256

      e68f08a021c90809c6075a9385a2b80cb025877ffa1a09b0b6c122c3d726e7c4

    • SHA512

      23328ca70828e9977a06f6525d5beda6c5a9137778e4ded83307fcc40c9e1006b00a6e4315fdadb1629873e3a3ee94f513b3af0719ad9d7b04897e4299b1fdf3

    • SSDEEP

      1536:HYL53ZzLd2QZO6wug6yohaL+obgGlvkW0GJ1d:HYV3Rd2QZ5foSGlx0u/

    Score
    10/10
    blackmoonbankerpersistencetrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks