Overview

overview

10

Static

static

10

61356a0d65438f_JC.exe

windows7-x64

10

61356a0d65438f_JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61356a0d65438f_JC.exe

  • Size

    2.0MB

  • Sample

    230716-lspngaeh3z

  • MD5

    61356a0d65438f9f32b2049575e4ea07

  • SHA1

    bd035174d84c40a79da124b4c4a750a562383290

  • SHA256

    556fbb0791d405af7f0d9e5de945ce245ef23fdbe658349c1c6819f52877f71a

  • SHA512

    cee79aa6064965685dfa325371f6c6be071ea6548adfa04436fa034ea33fe19e4db4785b7720cdf9ce5387b08b63ae18deb5bd02d4dfdcbbd59a451449ee2192

  • SSDEEP

    24576:PSH25PwcN2jx23LdZNtWFKV8IdaY5VFt1LuqJhDqGFeyUQPurCD8JYjSK5ECg:PlDoOTNtGKaIvfuRVy/Pur2Mgg

Score
10/10
blackmoonbankerbootkitpersistencetrojan

Malware Config

Targets

    • Target

      61356a0d65438f_JC.exe

    • Size

      2.0MB

    • MD5

      61356a0d65438f9f32b2049575e4ea07

    • SHA1

      bd035174d84c40a79da124b4c4a750a562383290

    • SHA256

      556fbb0791d405af7f0d9e5de945ce245ef23fdbe658349c1c6819f52877f71a

    • SHA512

      cee79aa6064965685dfa325371f6c6be071ea6548adfa04436fa034ea33fe19e4db4785b7720cdf9ce5387b08b63ae18deb5bd02d4dfdcbbd59a451449ee2192

    • SSDEEP

      24576:PSH25PwcN2jx23LdZNtWFKV8IdaY5VFt1LuqJhDqGFeyUQPurCD8JYjSK5ECg:PlDoOTNtGKaIvfuRVy/Pur2Mgg

    Score
    10/10
    blackmoonbankerbootkitpersistencetrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks