Overview

overview

10

Static

static

8

6638ca5e79...85.exe

windows7-x64

10

6638ca5e79...85.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6638ca5e79e54398cfb705e1f76e5e8ac86c0e097ad6717da5cb6b067f7a8e85

  • Size

    3.7MB

  • Sample

    221126-hc612ahe99

  • MD5

    4e354d702744838b1d89838aaf4dc589

  • SHA1

    d6c1a22b81f8f35e2ddba551ac13ea39ac5b0666

  • SHA256

    6638ca5e79e54398cfb705e1f76e5e8ac86c0e097ad6717da5cb6b067f7a8e85

  • SHA512

    325ae3275df86d5bb1f40775c8e49882a9f65b10d0e6df6374172e832c2da660125938f5f96706c57da78537b51a6ba3df4ca5753c18edbf496e171bd1f05774

  • SSDEEP

    98304:v0/vvhTtozYBsRQBurNfBizdmAd7lamGxpVOjnHYg:kvheIsOmcmA5lamYKEg

Score
10/10
blackmoonbankerbootkitpersistencetrojanvmprotect

Malware Config

Targets

    • Target

      6638ca5e79e54398cfb705e1f76e5e8ac86c0e097ad6717da5cb6b067f7a8e85

    • Size

      3.7MB

    • MD5

      4e354d702744838b1d89838aaf4dc589

    • SHA1

      d6c1a22b81f8f35e2ddba551ac13ea39ac5b0666

    • SHA256

      6638ca5e79e54398cfb705e1f76e5e8ac86c0e097ad6717da5cb6b067f7a8e85

    • SHA512

      325ae3275df86d5bb1f40775c8e49882a9f65b10d0e6df6374172e832c2da660125938f5f96706c57da78537b51a6ba3df4ca5753c18edbf496e171bd1f05774

    • SSDEEP

      98304:v0/vvhTtozYBsRQBurNfBizdmAd7lamGxpVOjnHYg:kvheIsOmcmA5lamYKEg

    Score
    10/10
    blackmoonbankerbootkitpersistencetrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks