General

  • Target

    c61ecaeab40591b89f8138333499b40a0060e02ce11403499e829b7f588e7a12

  • Size

    260KB

  • Sample

    221123-xpvabsaf5t

  • MD5

    fc2e73824f78609c27efab5fa7c73493

  • SHA1

    78d62dec4ba87bd8ed0ee9751b63fc5d0668dc3a

  • SHA256

    c61ecaeab40591b89f8138333499b40a0060e02ce11403499e829b7f588e7a12

  • SHA512

    abbae4bf59f442b01a0186a0e0c63a5b41c67c43ace11b8e1c2ad1a094c4b1b9fb60f074800bf05034e9e5bf7fe01ae2323e0a2fcacda353267514b8fc8e0f6e

  • SSDEEP

    6144:LhR5nr+Pzr1Gq/Jf+2upbKOCeY9nP878g9M:9r+PfP/J2baecrg9M

Malware Config

Targets

    • Target

      c61ecaeab40591b89f8138333499b40a0060e02ce11403499e829b7f588e7a12

    • Size

      260KB

    • MD5

      fc2e73824f78609c27efab5fa7c73493

    • SHA1

      78d62dec4ba87bd8ed0ee9751b63fc5d0668dc3a

    • SHA256

      c61ecaeab40591b89f8138333499b40a0060e02ce11403499e829b7f588e7a12

    • SHA512

      abbae4bf59f442b01a0186a0e0c63a5b41c67c43ace11b8e1c2ad1a094c4b1b9fb60f074800bf05034e9e5bf7fe01ae2323e0a2fcacda353267514b8fc8e0f6e

    • SSDEEP

      6144:LhR5nr+Pzr1Gq/Jf+2upbKOCeY9nP878g9M:9r+PfP/J2baecrg9M

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v6

Tasks