Overview

overview

10

Static

static

7

fb05dd4a7f...f3.exe

windows7-x64

10

fb05dd4a7f...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb05dd4a7f044f7e1cde8efb864f761c1e6a03e4dfd737dd52407dbf933f8bf3

  • Size

    1.3MB

  • Sample

    230619-yh9xwaha6z

  • MD5

    0fff06edf52de0cc26c79ed7ed1b31e4

  • SHA1

    984f1e94af2093a683ac387a356fcb7017bfff65

  • SHA256

    fb05dd4a7f044f7e1cde8efb864f761c1e6a03e4dfd737dd52407dbf933f8bf3

  • SHA512

    bea4f597566ca0dc3ce6931d32d616c93186d9dfc566047d64347661c9ac963190a19aa6c04862da6e4beb3a5944c4bbe53e8b0991a305c1ba60d8276263f686

  • SSDEEP

    24576:Pm03NU1px3LX2pV5DN0AVHdD9BBkOunb+K1SEQTizWLzk0nzF:Pm0S1pynNvV9BBBkOC+E5eOW5

Score
10/10
blackmoonaspackv2bankertrojanupx

Malware Config

Targets

    • Target

      fb05dd4a7f044f7e1cde8efb864f761c1e6a03e4dfd737dd52407dbf933f8bf3

    • Size

      1.3MB

    • MD5

      0fff06edf52de0cc26c79ed7ed1b31e4

    • SHA1

      984f1e94af2093a683ac387a356fcb7017bfff65

    • SHA256

      fb05dd4a7f044f7e1cde8efb864f761c1e6a03e4dfd737dd52407dbf933f8bf3

    • SHA512

      bea4f597566ca0dc3ce6931d32d616c93186d9dfc566047d64347661c9ac963190a19aa6c04862da6e4beb3a5944c4bbe53e8b0991a305c1ba60d8276263f686

    • SSDEEP

      24576:Pm03NU1px3LX2pV5DN0AVHdD9BBkOunb+K1SEQTizWLzk0nzF:Pm0S1pynNvV9BBBkOC+E5eOW5

    Score
    10/10
    blackmoonaspackv2bankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Downloads MZ/PE file

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks