Overview

overview

10

Static

static

f85493eb92...af.exe

windows7-x64

10

f85493eb92...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f85493eb920b677f50fd08b754835dd40947baeced9ce7c2ab55a47f818502af

  • Size

    141KB

  • Sample

    221129-kq6zasgd2x

  • MD5

    7caf6ee9eebf68f826380c415379cc4a

  • SHA1

    7f1bce79857a2885cd8b0188951483466f5e4390

  • SHA256

    f85493eb920b677f50fd08b754835dd40947baeced9ce7c2ab55a47f818502af

  • SHA512

    ddca353eb7a473a24faacd41755395f3f6096f930c62ab51a845faf2a5742b508622b1e265954a30d6406eb350230aa2500bba167d36ff1d6674ad48cda32e51

  • SSDEEP

    3072:sS13dexXhf2hek4txILwTFnvt2c3Ek4oAJ/gDH9gzuaEgTsDz:sS1twl2he9RIc0kBzuu+s

Score
10/10
blackmoonbankerpersistencetrojanvmprotect

Malware Config

Targets

    • Target

      f85493eb920b677f50fd08b754835dd40947baeced9ce7c2ab55a47f818502af

    • Size

      141KB

    • MD5

      7caf6ee9eebf68f826380c415379cc4a

    • SHA1

      7f1bce79857a2885cd8b0188951483466f5e4390

    • SHA256

      f85493eb920b677f50fd08b754835dd40947baeced9ce7c2ab55a47f818502af

    • SHA512

      ddca353eb7a473a24faacd41755395f3f6096f930c62ab51a845faf2a5742b508622b1e265954a30d6406eb350230aa2500bba167d36ff1d6674ad48cda32e51

    • SSDEEP

      3072:sS13dexXhf2hek4txILwTFnvt2c3Ek4oAJ/gDH9gzuaEgTsDz:sS1twl2he9RIc0kBzuu+s

    Score
    10/10
    blackmoonbankerpersistencetrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Drops file in Drivers directory

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks