Overview

overview

10

Static

static

1819831b43...85.exe

windows7-x64

10

1819831b43...85.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1819831b43c421590d8742f7d94e9b0e9d8d9a82595cd3f43c77dc2566085185

  • Size

    65KB

  • Sample

    221125-zzxvbafc25

  • MD5

    7ec61f645aab81627a9482b7c34e4cb0

  • SHA1

    de314b3879d216e55a9546f7c90f43a273cb2167

  • SHA256

    1819831b43c421590d8742f7d94e9b0e9d8d9a82595cd3f43c77dc2566085185

  • SHA512

    d8a7161317ccd361c77af943a456a455af939f80e3293d8ae2fb7963304e54f1c2bf27af94872ae68f6d7093cfd28e12c35f465b31ec93a9f318f6cec9a7ca06

  • SSDEEP

    1536:qKr7HBW4K+N2hhzGeckCrFm+GTbUsEtlwMB2:b7HBWz+AnckUGTb3EDwA2

Score
10/10
blackmoonbankerpersistencetrojan

Malware Config

Targets

    • Target

      1819831b43c421590d8742f7d94e9b0e9d8d9a82595cd3f43c77dc2566085185

    • Size

      65KB

    • MD5

      7ec61f645aab81627a9482b7c34e4cb0

    • SHA1

      de314b3879d216e55a9546f7c90f43a273cb2167

    • SHA256

      1819831b43c421590d8742f7d94e9b0e9d8d9a82595cd3f43c77dc2566085185

    • SHA512

      d8a7161317ccd361c77af943a456a455af939f80e3293d8ae2fb7963304e54f1c2bf27af94872ae68f6d7093cfd28e12c35f465b31ec93a9f318f6cec9a7ca06

    • SSDEEP

      1536:qKr7HBW4K+N2hhzGeckCrFm+GTbUsEtlwMB2:b7HBWz+AnckUGTb3EDwA2

    Score
    10/10
    blackmoonbankerpersistencetrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks