Overview

overview

10

Static

static

10

2848c3239c...60.exe

windows7-x64

10

2848c3239c...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2848c3239c8e587b65bef9db5940824bc5126a4928cabf885049581283d6f260

  • Size

    356KB

  • Sample

    221128-yla8qacd72

  • MD5

    ee7a29a3f6ee847cebd8c2bc6d6270c0

  • SHA1

    529069f28001bd2d59afb52a3d68224fc7b6c070

  • SHA256

    2848c3239c8e587b65bef9db5940824bc5126a4928cabf885049581283d6f260

  • SHA512

    98307fc036a86b05028bce4d98b9be0359414ec09d3b1d170b1457bf4043e83f87bcaeea4849aadc880dd6ecd102ab8432725da4ce803ff7fe5b2600ad5f31a9

  • SSDEEP

    6144:nAZ26bMC4ZnX0NCqyITT+T6lPg5jC5SEmb++7Uym0kmsXMiLOFo02RF3o:nAZxbMCgX0GITXlUgSbgj0jikr23Y

Score
10/10
blackmoonbankerpersistencetrojan

Malware Config

Targets

    • Target

      2848c3239c8e587b65bef9db5940824bc5126a4928cabf885049581283d6f260

    • Size

      356KB

    • MD5

      ee7a29a3f6ee847cebd8c2bc6d6270c0

    • SHA1

      529069f28001bd2d59afb52a3d68224fc7b6c070

    • SHA256

      2848c3239c8e587b65bef9db5940824bc5126a4928cabf885049581283d6f260

    • SHA512

      98307fc036a86b05028bce4d98b9be0359414ec09d3b1d170b1457bf4043e83f87bcaeea4849aadc880dd6ecd102ab8432725da4ce803ff7fe5b2600ad5f31a9

    • SSDEEP

      6144:nAZ26bMC4ZnX0NCqyITT+T6lPg5jC5SEmb++7Uym0kmsXMiLOFo02RF3o:nAZxbMCgX0GITXlUgSbgj0jikr23Y

    Score
    10/10
    blackmoonbankerpersistencetrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks