Overview

overview

10

Static

static

10

a7f8089d3a...db.exe

windows7-x64

10

a7f8089d3a...db.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a7f8089d3a33329e1bd37a4b802e4cdb.exe

  • Size

    2.0MB

  • Sample

    221231-jptrxace9z

  • MD5

    a7f8089d3a33329e1bd37a4b802e4cdb

  • SHA1

    fd70a39e6a9f355546fb2d13ecb943ffc02cb2a0

  • SHA256

    da1def22e92bbfa93dbb221c28d35e82ab2a82472893a0e7a1e56921b1a05c52

  • SHA512

    698671142cbe9dac2d9db01e8810874a194a75a13c725785a8a5d096a33610fc1b11af38fc939c2a4c1eee4275dc2c7da00249b26e0ecede637ada1cde7208f4

  • SSDEEP

    49152:fstyTbefPOI3kntRDDDDDDn2IiUwtm045FfZ:UuuPQGm04Px

Score
10/10
blackmoonbankerpersistencetrojanupx

Malware Config

Targets

    • Target

      a7f8089d3a33329e1bd37a4b802e4cdb.exe

    • Size

      2.0MB

    • MD5

      a7f8089d3a33329e1bd37a4b802e4cdb

    • SHA1

      fd70a39e6a9f355546fb2d13ecb943ffc02cb2a0

    • SHA256

      da1def22e92bbfa93dbb221c28d35e82ab2a82472893a0e7a1e56921b1a05c52

    • SHA512

      698671142cbe9dac2d9db01e8810874a194a75a13c725785a8a5d096a33610fc1b11af38fc939c2a4c1eee4275dc2c7da00249b26e0ecede637ada1cde7208f4

    • SSDEEP

      49152:fstyTbefPOI3kntRDDDDDDn2IiUwtm045FfZ:UuuPQGm04Px

    Score
    10/10
    blackmoonbankerpersistencetrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks