blackmoon | 5cedc86c7b32e5b3a83fdab800e6bbc650919ccdc778f75cb69541f4a15d91af | Triage

Submit
Reports

Overview

overview

Static

static

5cedc86c7b...af.exe

windows7-x64

5cedc86c7b...af.exe

windows10-2004-x64

Sharing

General

Target

5cedc86c7b32e5b3a83fdab800e6bbc650919ccdc778f75cb69541f4a15d91af
Size

114KB
Sample

221125-jn8vfabh94
MD5

af30ea13a0721fb3e3b95c9824306941
SHA1

feaa318b3f735c8c0f6377adc98489256edca988
SHA256

5cedc86c7b32e5b3a83fdab800e6bbc650919ccdc778f75cb69541f4a15d91af
SHA512

d77bd0e58dda70cbcda742de520a979e0114184374fee12cbbfcf987ff8155c23caf4a97970af8e5caa30b49b707568c4abe4614e297dc4d2422fe03cea1fcab
SSDEEP

1536:PYOoVTjI9O31bY2/CyON4CsS2c92NYu3qb5KeopfL3dDtI+RZ7:PYO4I9OlbTq72WuS5VgL3dDtIE

Score

10^/10

blackmoon banker persistence trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

5cedc86c7b32e5b3a83fdab800e6bbc650919ccdc778f75cb69541f4a15d91af.exe

Resource

win7-20221111-en

blackmoon banker persistence trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

5cedc86c7b32e5b3a83fdab800e6bbc650919ccdc778f75cb69541f4a15d91af.exe

Resource

win10v2004-20221111-en

blackmoon banker persistence trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  5cedc86c7b32e5b3a83fdab800e6bbc650919ccdc778f75cb69541f4a15d91af
- Size
  
  114KB
- MD5
  
  af30ea13a0721fb3e3b95c9824306941
- SHA1
  
  feaa318b3f735c8c0f6377adc98489256edca988
- SHA256
  
  5cedc86c7b32e5b3a83fdab800e6bbc650919ccdc778f75cb69541f4a15d91af
- SHA512
  
  d77bd0e58dda70cbcda742de520a979e0114184374fee12cbbfcf987ff8155c23caf4a97970af8e5caa30b49b707568c4abe4614e297dc4d2422fe03cea1fcab
- SSDEEP
  
  1536:PYOoVTjI9O31bY2/CyON4CsS2c92NYu3qb5KeopfL3dDtI+RZ7:PYO4I9OlbTq72WuS5VgL3dDtIE
Score

10^/10

blackmoon banker persistence trojan
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerpersistencetrojan

behavioral2

blackmoonbankerpersistencetrojan

© 2018-2024

Terms | Privacy