Overview

overview

10

Static

static

1ebbd7ee49...96.exe

windows7-x64

10

1ebbd7ee49...96.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996

  • Size

    62KB

  • Sample

    221125-spr3raba6s

  • MD5

    8df904b9e96ae8c9275aa19ce09bbf8a

  • SHA1

    be1ebdc42147c3015569e6a5396c8918219e05d8

  • SHA256

    1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996

  • SHA512

    ac2e152ee2fdc62479f685dd6124163a78081bc9be78586c1d5bab73187203d3a20daaee7ba8fe6a49372c9ca7c2fd23550e2198accdb9d47d2462d32faa3365

  • SSDEEP

    1536:DM84HouVCAa/5akUnYdE6gqvCGy7R9r9W/71/39:DMtIuVCL4GlgqvCH99r9y7h3

Score
10/10
blackmoonbankerpersistencetrojan

Malware Config

Targets

    • Target

      1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996

    • Size

      62KB

    • MD5

      8df904b9e96ae8c9275aa19ce09bbf8a

    • SHA1

      be1ebdc42147c3015569e6a5396c8918219e05d8

    • SHA256

      1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996

    • SHA512

      ac2e152ee2fdc62479f685dd6124163a78081bc9be78586c1d5bab73187203d3a20daaee7ba8fe6a49372c9ca7c2fd23550e2198accdb9d47d2462d32faa3365

    • SSDEEP

      1536:DM84HouVCAa/5akUnYdE6gqvCGy7R9r9W/71/39:DMtIuVCL4GlgqvCH99r9y7h3

    Score
    10/10
    blackmoonbankerpersistencetrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks