Overview

overview

10

Static

static

10

07530199.exe

windows7-x64

10

07530199.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07530199.exe

  • Size

    277KB

  • Sample

    230529-kaymzsbb9y

  • MD5

    5ac529b84bed8f7e3428245e47a78667

  • SHA1

    3da3922f429143ccb6d0c3224e3d189c9bb31fa6

  • SHA256

    1989d2f3db46b9c5c949f4b8498cda2a2fde7b08e4c5d1267950debe82daa2fc

  • SHA512

    1093d5ddb6c4834b0b8389dc9fa648aad37ab9b170c908e6b9bb37354e1b3906db0b8485a44ab3b0a545bbe2868bfe6229488830b9c925c26f3a78bd83166962

  • SSDEEP

    6144:sbFMvcdKa1rEgjpI+tK9/DYag1dNqaFm:sbFMEdKa1Jjl89/DYayT

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      07530199.exe

    • Size

      277KB

    • MD5

      5ac529b84bed8f7e3428245e47a78667

    • SHA1

      3da3922f429143ccb6d0c3224e3d189c9bb31fa6

    • SHA256

      1989d2f3db46b9c5c949f4b8498cda2a2fde7b08e4c5d1267950debe82daa2fc

    • SHA512

      1093d5ddb6c4834b0b8389dc9fa648aad37ab9b170c908e6b9bb37354e1b3906db0b8485a44ab3b0a545bbe2868bfe6229488830b9c925c26f3a78bd83166962

    • SSDEEP

      6144:sbFMvcdKa1rEgjpI+tK9/DYag1dNqaFm:sbFMEdKa1Jjl89/DYayT

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Deletes itself

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks