Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    1.9MB

  • Sample

    230711-rb1x3aae5y

  • MD5

    e5aad337eb94f764f8a05aeaddbec2df

  • SHA1

    eeb1a8d621b45b3fd7ab521b522a946834a25d31

  • SHA256

    e42c82fd5db6848c96c01254dc3f3551a9180ba5f82750058fdb7180386084d7

  • SHA512

    3568fcf61f82b1d1f1ab3aa703ead77b12a917bd3718cd13e9a0d729ac248aa31e9af7e2a68b9aa0e50cdaad88ec32b651cdd16bc31cb9a6db603cdfa6dafb43

  • SSDEEP

    24576:iYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnOyzrRRDWRvIHwZ1PEEa+prqez7iJNOlKzX:iYREXSVMDi3fzABeohfZ7wSM

Score
10/10
blackmoongh0stratbankerpersistencerattrojan

Malware Config

Targets

    • Target

      tmp

    • Size

      1.9MB

    • MD5

      e5aad337eb94f764f8a05aeaddbec2df

    • SHA1

      eeb1a8d621b45b3fd7ab521b522a946834a25d31

    • SHA256

      e42c82fd5db6848c96c01254dc3f3551a9180ba5f82750058fdb7180386084d7

    • SHA512

      3568fcf61f82b1d1f1ab3aa703ead77b12a917bd3718cd13e9a0d729ac248aa31e9af7e2a68b9aa0e50cdaad88ec32b651cdd16bc31cb9a6db603cdfa6dafb43

    • SSDEEP

      24576:iYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnOyzrRRDWRvIHwZ1PEEa+prqez7iJNOlKzX:iYREXSVMDi3fzABeohfZ7wSM

    Score
    10/10
    blackmoongh0stratbankerpersistencerattrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks