Overview

overview

10

Static

static

08b3a3bf85...b9.exe

windows7-x64

10

08b3a3bf85...b9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9

  • Size

    1.2MB

  • Sample

    221125-x5tczahh99

  • MD5

    46f5c782c75543890fa65123b9eca01a

  • SHA1

    82f6f68b26669467e65795789129f7d4745ce520

  • SHA256

    08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9

  • SHA512

    58ff8d5bf09dc81e5d567673e4e630e6a4ac8916e483f1404cc663a50e3c33906e2d2b3795badb5f4c8507d589ae8fa7bba1fb32efe81c437c1560072c159958

  • SSDEEP

    24576:nZqEW3VUoK63ZiglUaMQ2uZEGQoIVwxn8kK2o:bW3K6ZF6aMJui4I258kK

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9

    • Size

      1.2MB

    • MD5

      46f5c782c75543890fa65123b9eca01a

    • SHA1

      82f6f68b26669467e65795789129f7d4745ce520

    • SHA256

      08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9

    • SHA512

      58ff8d5bf09dc81e5d567673e4e630e6a4ac8916e483f1404cc663a50e3c33906e2d2b3795badb5f4c8507d589ae8fa7bba1fb32efe81c437c1560072c159958

    • SSDEEP

      24576:nZqEW3VUoK63ZiglUaMQ2uZEGQoIVwxn8kK2o:bW3K6ZF6aMJui4I258kK

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks