Overview

overview

10

Static

static

10

0b13d161e6...f1.exe

windows7-x64

10

0b13d161e6...f1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b13d161e6e0dbc20f9198a95c97ca1d069329e0ea4fe1c252161795aecd0bf1

  • Size

    4.9MB

  • Sample

    230608-npsxtseh38

  • MD5

    0791e5737019684103196c5d16e5c341

  • SHA1

    c81f7baabecd09e7dcf2f08968513516517650b4

  • SHA256

    0b13d161e6e0dbc20f9198a95c97ca1d069329e0ea4fe1c252161795aecd0bf1

  • SHA512

    0cd033bc2627bda1e8c891e3752426ec5160d1767a867d1a1df929611823f6e66a6003ab5017a14b5542b566d5fd183648e1543413193180d4b3720235cacb0a

  • SSDEEP

    98304:iRW1xgTyFb6ndoU+GOaS8NeokpgCl/8EuEJBI8gJwdUTaOJCi/SVrH5:jySbKo0FNeb2CZ8EuEA721O9/SVD5

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      0b13d161e6e0dbc20f9198a95c97ca1d069329e0ea4fe1c252161795aecd0bf1

    • Size

      4.9MB

    • MD5

      0791e5737019684103196c5d16e5c341

    • SHA1

      c81f7baabecd09e7dcf2f08968513516517650b4

    • SHA256

      0b13d161e6e0dbc20f9198a95c97ca1d069329e0ea4fe1c252161795aecd0bf1

    • SHA512

      0cd033bc2627bda1e8c891e3752426ec5160d1767a867d1a1df929611823f6e66a6003ab5017a14b5542b566d5fd183648e1543413193180d4b3720235cacb0a

    • SSDEEP

      98304:iRW1xgTyFb6ndoU+GOaS8NeokpgCl/8EuEJBI8gJwdUTaOJCi/SVrH5:jySbKo0FNeb2CZ8EuEA721O9/SVD5

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks