Overview

overview

10

Static

static

1

18d6f5e4ec...f3.exe

windows7-x64

10

18d6f5e4ec...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18d6f5e4ec32987307342fe6ddee304ea38704d45d19ef7626be6b5e72608df3

  • Size

    1.9MB

  • Sample

    230316-m2p62aae54

  • MD5

    3202d225f0e5c40b10c5c97c48d0a1f4

  • SHA1

    be16d53281f0efb98b771416aab76ebe275de2bd

  • SHA256

    18d6f5e4ec32987307342fe6ddee304ea38704d45d19ef7626be6b5e72608df3

  • SHA512

    4ac24ca0e59dae7773b5ac56bfbc33929d055a98aedef1c4df0017f4155c7c83e0c912856e23c26b8137cc46535f713e52eeca752a0368c5cfedcf352dea1583

  • SSDEEP

    49152:jPIuk9fRS95WYWtF8WSjLpmgvzbUkE5QC9d1GQ0x:jPIPJS95WYWtF8WSjLpmgvzbUkE5QC9

Score
10/10
blackmoongh0stratbankerpersistencerattrojan

Malware Config

Targets

    • Target

      18d6f5e4ec32987307342fe6ddee304ea38704d45d19ef7626be6b5e72608df3

    • Size

      1.9MB

    • MD5

      3202d225f0e5c40b10c5c97c48d0a1f4

    • SHA1

      be16d53281f0efb98b771416aab76ebe275de2bd

    • SHA256

      18d6f5e4ec32987307342fe6ddee304ea38704d45d19ef7626be6b5e72608df3

    • SHA512

      4ac24ca0e59dae7773b5ac56bfbc33929d055a98aedef1c4df0017f4155c7c83e0c912856e23c26b8137cc46535f713e52eeca752a0368c5cfedcf352dea1583

    • SSDEEP

      49152:jPIuk9fRS95WYWtF8WSjLpmgvzbUkE5QC9d1GQ0x:jPIPJS95WYWtF8WSjLpmgvzbUkE5QC9

    Score
    10/10
    blackmoongh0stratbankerpersistencerattrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks