Overview

overview

10

Static

static

10

0927e4d14d...fa.exe

windows7-x64

10

0927e4d14d...fa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa

  • Size

    82KB

  • Sample

    221125-yeq1ladg5x

  • MD5

    3c86ad63c6884aacde7f7c574a9a5593

  • SHA1

    9f9793fe31566dd24750efe8fc8a6a0c43f023af

  • SHA256

    0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa

  • SHA512

    aee9dc5bf4dfef41cb5c868e48dc8cc344c3604edf097fdeb6a5a6109b229831dc970e72b0af452b2d270e2c21bf54913079076a6ff19381623450068f9ec95b

  • SSDEEP

    1536:/sVyZh7S+jOvKCuv+5eKQ2vES36M7o5jUabtHnIwGsdbMK:/d2KC++5eKQ2vEK37oV3toHa

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa

    • Size

      82KB

    • MD5

      3c86ad63c6884aacde7f7c574a9a5593

    • SHA1

      9f9793fe31566dd24750efe8fc8a6a0c43f023af

    • SHA256

      0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa

    • SHA512

      aee9dc5bf4dfef41cb5c868e48dc8cc344c3604edf097fdeb6a5a6109b229831dc970e72b0af452b2d270e2c21bf54913079076a6ff19381623450068f9ec95b

    • SSDEEP

      1536:/sVyZh7S+jOvKCuv+5eKQ2vES36M7o5jUabtHnIwGsdbMK:/d2KC++5eKQ2vEK37oV3toHa

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks