Overview

overview

10

Static

static

7

7a8a646686...c2.exe

windows7-x64

10

7a8a646686...c2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2

  • Size

    4.3MB

  • Sample

    230616-gedxlada66

  • MD5

    5d0e87871d554bdb153eb75b0720f729

  • SHA1

    96db1dc26cd26f328654f1e8b030ec5b6b0af42a

  • SHA256

    7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2

  • SHA512

    98f7cf7e5d15996e172417a10234482e440a36bcbe8b7e27de311f7ac3faa0c3f30d9d5e7656d494ca2469444973b1c4ce2aa23bccaab8a3dd490a733aaab29b

  • SSDEEP

    98304:x7fqJV1f69j2Sqija0KnO+mgmCeYOv7bmZygiXbrUP:1qYRja04mglKbmZNKrUP

Score
10/10
blackmoonaspackv2bankerbootkitpersistencetrojanupx

Malware Config

Targets

    • Target

      7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2

    • Size

      4.3MB

    • MD5

      5d0e87871d554bdb153eb75b0720f729

    • SHA1

      96db1dc26cd26f328654f1e8b030ec5b6b0af42a

    • SHA256

      7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2

    • SHA512

      98f7cf7e5d15996e172417a10234482e440a36bcbe8b7e27de311f7ac3faa0c3f30d9d5e7656d494ca2469444973b1c4ce2aa23bccaab8a3dd490a733aaab29b

    • SSDEEP

      98304:x7fqJV1f69j2Sqija0KnO+mgmCeYOv7bmZygiXbrUP:1qYRja04mglKbmZNKrUP

    Score
    10/10
    blackmoonbankerbootkitpersistencetrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks