Overview

overview

10

Static

static

10

DKCat.exe

windows7-x64

10

DKCat.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DKCat.exe

  • Size

    17.2MB

  • Sample

    230720-ngxaaagb98

  • MD5

    7192bbfd6821694aef377cf7d21846f6

  • SHA1

    470f520859048e63cfde70206e47266e2d9f5aeb

  • SHA256

    ef7520c0e507c804fc5dd365395d118c342bda99efbea0b9a9988847c22e3476

  • SHA512

    c4d85f99671094e866f83c465cc2fc1923d6cd7fa1962f3431471a8cf1ce13cbb51886ae0b7b7320c4e2fae77da29586d076ae8e32b59d3167b5ee4cdb1bc511

  • SSDEEP

    393216:o+XjgI884sQiasvvLNOmYg3r3d51AyzmkiFmRuEj:o+XjS8XhasvvLNfpbN5aYgsgA

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      DKCat.exe

    • Size

      17.2MB

    • MD5

      7192bbfd6821694aef377cf7d21846f6

    • SHA1

      470f520859048e63cfde70206e47266e2d9f5aeb

    • SHA256

      ef7520c0e507c804fc5dd365395d118c342bda99efbea0b9a9988847c22e3476

    • SHA512

      c4d85f99671094e866f83c465cc2fc1923d6cd7fa1962f3431471a8cf1ce13cbb51886ae0b7b7320c4e2fae77da29586d076ae8e32b59d3167b5ee4cdb1bc511

    • SSDEEP

      393216:o+XjgI884sQiasvvLNOmYg3r3d51AyzmkiFmRuEj:o+XjS8XhasvvLNfpbN5aYgsgA

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks