blackmoon | ec43d1b21b5aa1f46ecf8d87d42b3512ef8ab1238dce21f957e4d2b7f48d199e | Triage

Submit
Reports

Overview

overview

Static

static

7

ec43d1b21b...9e.exe

windows7-x64

ec43d1b21b...9e.exe

windows10-2004-x64

Sharing

General

Target

ec43d1b21b5aa1f46ecf8d87d42b3512ef8ab1238dce21f957e4d2b7f48d199e
Size

1.3MB
Sample

230629-yqz3mseg58
MD5

94a84716982065ee4cd63f9771c6f393
SHA1

2c85a761c0b08213ba51b0834fe5c2d91c829845
SHA256

ec43d1b21b5aa1f46ecf8d87d42b3512ef8ab1238dce21f957e4d2b7f48d199e
SHA512

597c63f0387a131ff92d0ed2862f3cb495159fa65418be92c89bc4fc32a0d6af485af5e4cdb429b0e8ee07b2147b769332813e9b8035edb4a7d6a2a44e6b833c
SSDEEP

24576:UlKUaRL9e2/tgjto4mop2S1Jdhegf2h/LyGOn25big2D:6iR7lKmq7dhBSLyGOnuig2D

Score

10^/10

blackmoon banker trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

ec43d1b21b5aa1f46ecf8d87d42b3512ef8ab1238dce21f957e4d2b7f48d199e.exe

Resource

win7-20230621-en

blackmoon banker trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

ec43d1b21b5aa1f46ecf8d87d42b3512ef8ab1238dce21f957e4d2b7f48d199e.exe

Resource

win10v2004-20230621-en

blackmoon banker trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  ec43d1b21b5aa1f46ecf8d87d42b3512ef8ab1238dce21f957e4d2b7f48d199e
- Size
  
  1.3MB
- MD5
  
  94a84716982065ee4cd63f9771c6f393
- SHA1
  
  2c85a761c0b08213ba51b0834fe5c2d91c829845
- SHA256
  
  ec43d1b21b5aa1f46ecf8d87d42b3512ef8ab1238dce21f957e4d2b7f48d199e
- SHA512
  
  597c63f0387a131ff92d0ed2862f3cb495159fa65418be92c89bc4fc32a0d6af485af5e4cdb429b0e8ee07b2147b769332813e9b8035edb4a7d6a2a44e6b833c
- SSDEEP
  
  24576:UlKUaRL9e2/tgjto4mop2S1Jdhegf2h/LyGOn25big2D:6iR7lKmq7dhBSLyGOnuig2D
Score

10^/10

blackmoon banker trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankertrojanupx

behavioral2

blackmoonbankertrojanupx

© 2018-2024

Terms | Privacy