Overview

overview

10

Static

static

87e615a27e...e7.exe

windows7-x64

10

87e615a27e...e7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87e615a27eaef70769978c21db39c7b7548af36b6cbf89e3559546117fbf1fe7

  • Size

    276KB

  • Sample

    221126-k397gsfh35

  • MD5

    433a769506644ce47532aab64995d0fc

  • SHA1

    4266340817f67bfd16f3f2facc7ef6741026796d

  • SHA256

    87e615a27eaef70769978c21db39c7b7548af36b6cbf89e3559546117fbf1fe7

  • SHA512

    2fbc123aefac0b6a8f2a4bac9863f62d0f057cce9ff677b0868a07e36f648604d19fb36c9184ecea149b53ab61b6a1f822010bc3303a02603f79fa383eefaba6

  • SSDEEP

    6144:Q7lxePcy8+CNiKm6eL1Brx83XdH5RnIA81DxgEA1d/6gGpGMFSQylKPlWRHC:QhxePq+AjWh43XdZNlYDxgE2iAMkQ4F

Score
10/10
blackmoonbankerpersistencetrojan

Malware Config

Targets

    • Target

      87e615a27eaef70769978c21db39c7b7548af36b6cbf89e3559546117fbf1fe7

    • Size

      276KB

    • MD5

      433a769506644ce47532aab64995d0fc

    • SHA1

      4266340817f67bfd16f3f2facc7ef6741026796d

    • SHA256

      87e615a27eaef70769978c21db39c7b7548af36b6cbf89e3559546117fbf1fe7

    • SHA512

      2fbc123aefac0b6a8f2a4bac9863f62d0f057cce9ff677b0868a07e36f648604d19fb36c9184ecea149b53ab61b6a1f822010bc3303a02603f79fa383eefaba6

    • SSDEEP

      6144:Q7lxePcy8+CNiKm6eL1Brx83XdH5RnIA81DxgEA1d/6gGpGMFSQylKPlWRHC:QhxePq+AjWh43XdZNlYDxgE2iAMkQ4F

    Score
    10/10
    blackmoonbankerpersistencetrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks