Overview

overview

10

Static

static

7

2dff2fb200...72.exe

windows7-x64

10

2dff2fb200...72.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72

  • Size

    83KB

  • Sample

    230225-p6jk6ada31

  • MD5

    bd3c295ce6e20d9f10fcfd093732bb11

  • SHA1

    55c2d80f459fc9c4b4562ff837c437894cbd7284

  • SHA256

    2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72

  • SHA512

    f74e977621c3a64bc4da87e557b278be6cfcd40fad1befe4ea2970bd366cda3f5cd746cae44e4d525e968b8f939b9978a65d424ea59f0ba2af2e65e4b2894f60

  • SSDEEP

    1536:a94OZH9ziYXyeM2enykKXbFsv7EVqOjPNQ70dW9KRTBKKjncHnouy8dl:2HdGYlMixZsDAqOjPN/cKRTB1cHoutr

Score
10/10
blackmoonbankerbootkitpersistencetrojanupx

Malware Config

Targets

    • Target

      2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72

    • Size

      83KB

    • MD5

      bd3c295ce6e20d9f10fcfd093732bb11

    • SHA1

      55c2d80f459fc9c4b4562ff837c437894cbd7284

    • SHA256

      2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72

    • SHA512

      f74e977621c3a64bc4da87e557b278be6cfcd40fad1befe4ea2970bd366cda3f5cd746cae44e4d525e968b8f939b9978a65d424ea59f0ba2af2e65e4b2894f60

    • SSDEEP

      1536:a94OZH9ziYXyeM2enykKXbFsv7EVqOjPNQ70dW9KRTBKKjncHnouy8dl:2HdGYlMixZsDAqOjPN/cKRTB1cHoutr

    Score
    10/10
    blackmoonbankerbootkitpersistencetrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks