Overview

overview

10

Static

static

10

94fe4b29cc...63.exe

windows7-x64

10

94fe4b29cc...63.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94fe4b29ccc16d73ebea55a83e742e5b0a7231a5fc62f5ab33bc7dad3413f363

  • Size

    3.1MB

  • Sample

    230513-dg1btshe4s

  • MD5

    1145fc073c26ca9ab6a78d9c7c1faf2c

  • SHA1

    7cc1eef3a73566d1f134bb270f1bfbe8f9b588c8

  • SHA256

    94fe4b29ccc16d73ebea55a83e742e5b0a7231a5fc62f5ab33bc7dad3413f363

  • SHA512

    b4bcc89b362571c59071dc5ed177aa87c7248a57b2acb3b8311e4c47001ba57084c2c419de4ca26b1e4eefabf22a438a342bd0273c29e521e6f5124ef8930ec5

  • SSDEEP

    49152:3VQkN2zF9+d+j/wNEI31HCOohiId4/VmyUMlPw6rEDCEfihhmDT+E2Wt6ym++:lwCa/wNdFH/ogI6/VV3lYUUi6DT+68

Score
10/10
blackmoonbankerdiscoveryevasionspywarestealertrojanupx

Malware Config

Targets

    • Target

      94fe4b29ccc16d73ebea55a83e742e5b0a7231a5fc62f5ab33bc7dad3413f363

    • Size

      3.1MB

    • MD5

      1145fc073c26ca9ab6a78d9c7c1faf2c

    • SHA1

      7cc1eef3a73566d1f134bb270f1bfbe8f9b588c8

    • SHA256

      94fe4b29ccc16d73ebea55a83e742e5b0a7231a5fc62f5ab33bc7dad3413f363

    • SHA512

      b4bcc89b362571c59071dc5ed177aa87c7248a57b2acb3b8311e4c47001ba57084c2c419de4ca26b1e4eefabf22a438a342bd0273c29e521e6f5124ef8930ec5

    • SSDEEP

      49152:3VQkN2zF9+d+j/wNEI31HCOohiId4/VmyUMlPw6rEDCEfihhmDT+E2Wt6ym++:lwCa/wNdFH/ogI6/VV3lYUUi6DT+68

    Score
    10/10
    blackmoonbankerdiscoveryevasionspywarestealertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks