Overview

overview

10

Static

static

10

fedd708d19...28.exe

windows7-x64

10

fedd708d19...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fedd708d1934ff276287e5c58b8e0b110f66dbe2274889bf4fc4a686cd8e2c28

  • Size

    4.0MB

  • Sample

    230724-jt83dsbf37

  • MD5

    2b8cebcdc9b604c02a46f68ec92cd85e

  • SHA1

    5f56325e4f78deeafc865bb942f86eb85ab9e5df

  • SHA256

    fedd708d1934ff276287e5c58b8e0b110f66dbe2274889bf4fc4a686cd8e2c28

  • SHA512

    35fafe44c7d4710f8f4aa78398cc6adf614645b90b6928ad93ed8a0b93ea7f4c3ffca740159c7ad37600e779237d78ad30340385bcf06d65f57d4de3d377f6e4

  • SSDEEP

    98304:6LkCqK9jITuvn4LNfYWVV0FLOAkGkzdnEVomFHKnPr:ukCqM5AnV0FLOyomFHKnPr

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      fedd708d1934ff276287e5c58b8e0b110f66dbe2274889bf4fc4a686cd8e2c28

    • Size

      4.0MB

    • MD5

      2b8cebcdc9b604c02a46f68ec92cd85e

    • SHA1

      5f56325e4f78deeafc865bb942f86eb85ab9e5df

    • SHA256

      fedd708d1934ff276287e5c58b8e0b110f66dbe2274889bf4fc4a686cd8e2c28

    • SHA512

      35fafe44c7d4710f8f4aa78398cc6adf614645b90b6928ad93ed8a0b93ea7f4c3ffca740159c7ad37600e779237d78ad30340385bcf06d65f57d4de3d377f6e4

    • SSDEEP

      98304:6LkCqK9jITuvn4LNfYWVV0FLOAkGkzdnEVomFHKnPr:ukCqM5AnV0FLOyomFHKnPr

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks