blackmoon | a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

a9a6ae77b9...b4.exe

windows7-x64

a9a6ae77b9...b4.exe

windows10-2004-x64

Sharing

General

Target

a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4
Size

7.3MB
Sample

230820-e8pj3seh7v
MD5

f80dadc61dd4a914ce96139252df0aba
SHA1

ad8785e358f14f80083ca386b9505fbfa066c4b4
SHA256

a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4
SHA512

084a10db94dedf772f6ac6b964f13c0279b7fddcaadd69187ca50d994a7a83b143d02d3b5d0cd9c9102b34b5ef7f48a5db355cd97eddfb6e28ae22e3433f963e
SSDEEP

196608:H+23b3ntL9L2M8VKXGqIeP3ljBBFNzi3RPKLxhnZKW:H1Xd9L2M8VcIe1jARPKLxhnQW

Score

10^/10

blackmoon banker themida trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4.exe

Resource

win7-20230712-en

blackmoon banker themida trojan upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4.exe

Resource

win10v2004-20230703-en

blackmoon banker themida trojan upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4
- Size
  
  7.3MB
- MD5
  
  f80dadc61dd4a914ce96139252df0aba
- SHA1
  
  ad8785e358f14f80083ca386b9505fbfa066c4b4
- SHA256
  
  a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4
- SHA512
  
  084a10db94dedf772f6ac6b964f13c0279b7fddcaadd69187ca50d994a7a83b143d02d3b5d0cd9c9102b34b5ef7f48a5db355cd97eddfb6e28ae22e3433f963e
- SSDEEP
  
  196608:H+23b3ntL9L2M8VKXGqIeP3ljBBFNzi3RPKLxhnZKW:H1Xd9L2M8VcIe1jARPKLxhnQW
Score

10^/10

blackmoon banker themida trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerthemidatrojanupx

behavioral2

blackmoonbankerthemidatrojanupx

© 2018-2025

Terms | Privacy