Overview

overview

10

Static

static

10

dea9294a69...9c.dll

windows7-x64

10

dea9294a69...9c.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dea9294a69e0c35f866057c27f9177348454da02ac96eb0d2d4cfd671c8aee9c

  • Size

    5.5MB

  • Sample

    230709-xyp2zafd57

  • MD5

    1426430c076a96028efb1be7b211a8f8

  • SHA1

    71a417520e62e927db03543474e2f25d51a9e61f

  • SHA256

    dea9294a69e0c35f866057c27f9177348454da02ac96eb0d2d4cfd671c8aee9c

  • SHA512

    5c65ad28f1096799be7dd9e9f4be96ebca45cf9a6eb6d5ee7facd92f000e0d53c1ae04a37080b6d4d67464fb1a685149e1172180a4a2aca9da2efd69eb5e5232

  • SSDEEP

    49152:wqqw3Ig3FovIOoGfYtsXo7Kq1Ixg28kRNQc6ugHLxfobOftajN5Q+/jsHG3jAy5/:xJ3Fov2Ga7AKBrAN56at6D

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      dea9294a69e0c35f866057c27f9177348454da02ac96eb0d2d4cfd671c8aee9c

    • Size

      5.5MB

    • MD5

      1426430c076a96028efb1be7b211a8f8

    • SHA1

      71a417520e62e927db03543474e2f25d51a9e61f

    • SHA256

      dea9294a69e0c35f866057c27f9177348454da02ac96eb0d2d4cfd671c8aee9c

    • SHA512

      5c65ad28f1096799be7dd9e9f4be96ebca45cf9a6eb6d5ee7facd92f000e0d53c1ae04a37080b6d4d67464fb1a685149e1172180a4a2aca9da2efd69eb5e5232

    • SSDEEP

      49152:wqqw3Ig3FovIOoGfYtsXo7Kq1Ixg28kRNQc6ugHLxfobOftajN5Q+/jsHG3jAy5/:xJ3Fov2Ga7AKBrAN56at6D

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Blocklisted process makes network request

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks