General

  • Target

    fce58603d18b169d67fee4a3df7d39757a4126716703840acfe8cfb5e34990e9

  • Size

    688KB

  • Sample

    221126-ae7fksgf58

  • MD5

    b2e12c662badc96d34a096f48db2d85c

  • SHA1

    d6d99f90c0dd1a56a1285532254a1c92a6024077

  • SHA256

    fce58603d18b169d67fee4a3df7d39757a4126716703840acfe8cfb5e34990e9

  • SHA512

    52815a032f3f88758098757fe18bf575423f481a6e58586fc5f80105cce4d367373913516c802decb225e92b2fb0bf3c130163dc2e75d15b4239a16001dbde92

  • SSDEEP

    12288:Q8pU1gjXtuyO5lwwP5JuPi4k57It16nP0jaogTF4mFvnnkWTVb5VedvRoqr+In3/:Q8pUcU98wD6uIp2tL/35bLLRQ/

Malware Config

Targets

    • Target

      fce58603d18b169d67fee4a3df7d39757a4126716703840acfe8cfb5e34990e9

    • Size

      688KB

    • MD5

      b2e12c662badc96d34a096f48db2d85c

    • SHA1

      d6d99f90c0dd1a56a1285532254a1c92a6024077

    • SHA256

      fce58603d18b169d67fee4a3df7d39757a4126716703840acfe8cfb5e34990e9

    • SHA512

      52815a032f3f88758098757fe18bf575423f481a6e58586fc5f80105cce4d367373913516c802decb225e92b2fb0bf3c130163dc2e75d15b4239a16001dbde92

    • SSDEEP

      12288:Q8pU1gjXtuyO5lwwP5JuPi4k57It16nP0jaogTF4mFvnnkWTVb5VedvRoqr+In3/:Q8pUcU98wD6uIp2tL/35bLLRQ/

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Tasks