Overview

overview

10

Static

static

1

9903ca5030...5c.exe

windows7-x64

10

9903ca5030...5c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9903ca5030add425280eeafd0b5734e2d7a5ef3b461cfb1fe33185648af09d5c

  • Size

    4.1MB

  • Sample

    230710-1ph4vaeg4v

  • MD5

    5a15bed03693ab3de6bbbe67b91211e4

  • SHA1

    783f9d5a4938a6188a4e3f9b56af4f834a9e6101

  • SHA256

    9903ca5030add425280eeafd0b5734e2d7a5ef3b461cfb1fe33185648af09d5c

  • SHA512

    a8c81f2a7dd0ee723202c35bfce2708990a31bc2ed613c3acf6a73a1f11248877949910cf12f77bef4a63c0370d59297ef0ce59af4d6115196c442e2c9a93dc9

  • SSDEEP

    49152:bbILHmriT77k2uH9giYXbY4B7EWrTwsIPK59gZ6ZbaHcYz5aAVKiw6ZWqTG93jJ+:vMmrsk2ugRLYyEHFbg3Yz5J/693k3

Score
10/10
blackmoonbankerevasiontrojan

Malware Config

Targets

    • Target

      9903ca5030add425280eeafd0b5734e2d7a5ef3b461cfb1fe33185648af09d5c

    • Size

      4.1MB

    • MD5

      5a15bed03693ab3de6bbbe67b91211e4

    • SHA1

      783f9d5a4938a6188a4e3f9b56af4f834a9e6101

    • SHA256

      9903ca5030add425280eeafd0b5734e2d7a5ef3b461cfb1fe33185648af09d5c

    • SHA512

      a8c81f2a7dd0ee723202c35bfce2708990a31bc2ed613c3acf6a73a1f11248877949910cf12f77bef4a63c0370d59297ef0ce59af4d6115196c442e2c9a93dc9

    • SSDEEP

      49152:bbILHmriT77k2uH9giYXbY4B7EWrTwsIPK59gZ6ZbaHcYz5aAVKiw6ZWqTG93jJ+:vMmrsk2ugRLYyEHFbg3Yz5J/693k3

    Score
    10/10
    blackmoonbankerevasiontrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UAC bypass

      evasiontrojan

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks