Overview

overview

10

Static

static

f3942a758d...f0.exe

windows7-x64

10

f3942a758d...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3942a758d8c4391cfb11a6debdfa6ef4d192ac5cf987807821085e48aac0cf0

  • Size

    2.9MB

  • Sample

    221125-l2j5cahd47

  • MD5

    b268548dcd2b8ca3e52bba8165f161d9

  • SHA1

    88ae3583c252d77cd1b07250d7411ee17c849108

  • SHA256

    f3942a758d8c4391cfb11a6debdfa6ef4d192ac5cf987807821085e48aac0cf0

  • SHA512

    910ae252c24c217f63eb1dd283d956067649812b2ae0368ac3e88fe2fec6b994e479de8eca9e46aa5fb002c144dc3247c11f673d378aaf012dfd8ba471b044bb

  • SSDEEP

    49152:cIQJn2KWJmTEVL9gXwPuyGPyS87MlajdBGF8QKoNciYEKMl+U5JWowSEKv:cIQ12KWJwEL9TPoPP+MlaxkCoNciYE+U

Score
10/10
blackmoonbankerevasiontrojan

Malware Config

Targets

    • Target

      f3942a758d8c4391cfb11a6debdfa6ef4d192ac5cf987807821085e48aac0cf0

    • Size

      2.9MB

    • MD5

      b268548dcd2b8ca3e52bba8165f161d9

    • SHA1

      88ae3583c252d77cd1b07250d7411ee17c849108

    • SHA256

      f3942a758d8c4391cfb11a6debdfa6ef4d192ac5cf987807821085e48aac0cf0

    • SHA512

      910ae252c24c217f63eb1dd283d956067649812b2ae0368ac3e88fe2fec6b994e479de8eca9e46aa5fb002c144dc3247c11f673d378aaf012dfd8ba471b044bb

    • SSDEEP

      49152:cIQJn2KWJmTEVL9gXwPuyGPyS87MlajdBGF8QKoNciYEKMl+U5JWowSEKv:cIQ12KWJwEL9TPoPP+MlaxkCoNciYE+U

    Score
    10/10
    blackmoonbankerevasiontrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks