Overview

overview

10

Static

static

aa0f430e5c...d7.exe

windows7-x64

10

aa0f430e5c...d7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7

  • Size

    2.0MB

  • Sample

    221129-znh7saab3y

  • MD5

    cc888e112e6212bc0a77c5628ceb2e23

  • SHA1

    7c16d0c6349af720642109c67435236a3239d273

  • SHA256

    aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7

  • SHA512

    3b6c1121eac1d9609e2e20f923d6b80020701402a70abd3eaa7c2dc8035b047ff011c057ff101e59e4f8dcffbdd4f486f9224fb5c2336163cb9771a0612b0557

  • SSDEEP

    49152:P96pwkZmHLcZEQ8L09njnxvcjxFSKmQV00ObPT+Db0KZCgHk9:5okLcZEoZg3SV3+D4jn

Score
10/10
blackmoonbankerevasiontrojanupx

Malware Config

Targets

    • Target

      aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7

    • Size

      2.0MB

    • MD5

      cc888e112e6212bc0a77c5628ceb2e23

    • SHA1

      7c16d0c6349af720642109c67435236a3239d273

    • SHA256

      aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7

    • SHA512

      3b6c1121eac1d9609e2e20f923d6b80020701402a70abd3eaa7c2dc8035b047ff011c057ff101e59e4f8dcffbdd4f486f9224fb5c2336163cb9771a0612b0557

    • SSDEEP

      49152:P96pwkZmHLcZEQ8L09njnxvcjxFSKmQV00ObPT+Db0KZCgHk9:5okLcZEoZg3SV3+D4jn

    Score
    10/10
    blackmoonbankerevasiontrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks