Overview

overview

10

Static

static

7

8f47d47a9f...91.exe

windows7-x64

10

8f47d47a9f...91.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8f47d47a9f2886fe63f02daf1d5cf96f84a19dffcefeed1ac61b86aaa176ad91

  • Size

    15.6MB

  • Sample

    230818-y978csdf53

  • MD5

    40c31d39a3763f3981b6635bb7ef5df9

  • SHA1

    aa713e38709be8951f292c17356c16fda2bb0afc

  • SHA256

    8f47d47a9f2886fe63f02daf1d5cf96f84a19dffcefeed1ac61b86aaa176ad91

  • SHA512

    343ce7021b37e473cdab8ec49e7ee7b719c03afb653864793f2af9c3bb40c551e27020d39c397f9615cfac90c62ecacb3e08f9af547505ea979d3d596241b3da

  • SSDEEP

    393216:MPz8K3m8+wsHVu/ZtGvv49W4up6c5ZQ9Tt+Yk/CUIh:6zD2Zwss/75W4tCe9AdI

Score
10/10
blackmoonbankerbootkitpersistencetrojanupx

Malware Config

Targets

    • Target

      8f47d47a9f2886fe63f02daf1d5cf96f84a19dffcefeed1ac61b86aaa176ad91

    • Size

      15.6MB

    • MD5

      40c31d39a3763f3981b6635bb7ef5df9

    • SHA1

      aa713e38709be8951f292c17356c16fda2bb0afc

    • SHA256

      8f47d47a9f2886fe63f02daf1d5cf96f84a19dffcefeed1ac61b86aaa176ad91

    • SHA512

      343ce7021b37e473cdab8ec49e7ee7b719c03afb653864793f2af9c3bb40c551e27020d39c397f9615cfac90c62ecacb3e08f9af547505ea979d3d596241b3da

    • SSDEEP

      393216:MPz8K3m8+wsHVu/ZtGvv49W4up6c5ZQ9Tt+Yk/CUIh:6zD2Zwss/75W4tCe9AdI

    Score
    10/10
    blackmoonbankerbootkitpersistencetrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks