Overview

overview

10

Static

static

3

6f77680bd0...b8.dll

windows7-x64

8

6f77680bd0...b8.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6f77680bd0773b2c76406195aa33eb23fd2b4f409d3dccb78a4737c20c0758b8

  • Size

    299KB

  • Sample

    230731-23tyyabf92

  • MD5

    6e181fe5091721e07cfb6150f94e3b16

  • SHA1

    4f6e690bc16856249cdbde121d007f7748c2dafd

  • SHA256

    6f77680bd0773b2c76406195aa33eb23fd2b4f409d3dccb78a4737c20c0758b8

  • SHA512

    1c9f87b50fb340db14f404111cebf8b01a3cf9cc5795edb6855afa1fa9a54445d692610bff51b6753feb01743aa23cc825f5fe1e6c107285e269b80fa1cbfc68

  • SSDEEP

    6144:Mszj4kdmVXtO+ofngVeyytZlz5dnYAm/rTOyLq+HBunTBSqMcAO0X9:/jj2OPfgEyytZlz/WOyexnTg7cy

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      6f77680bd0773b2c76406195aa33eb23fd2b4f409d3dccb78a4737c20c0758b8

    • Size

      299KB

    • MD5

      6e181fe5091721e07cfb6150f94e3b16

    • SHA1

      4f6e690bc16856249cdbde121d007f7748c2dafd

    • SHA256

      6f77680bd0773b2c76406195aa33eb23fd2b4f409d3dccb78a4737c20c0758b8

    • SHA512

      1c9f87b50fb340db14f404111cebf8b01a3cf9cc5795edb6855afa1fa9a54445d692610bff51b6753feb01743aa23cc825f5fe1e6c107285e269b80fa1cbfc68

    • SSDEEP

      6144:Mszj4kdmVXtO+ofngVeyytZlz5dnYAm/rTOyLq+HBunTBSqMcAO0X9:/jj2OPfgEyytZlz/WOyexnTg7cy

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Blocklisted process makes network request

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks