Overview

overview

10

Static

static

7

c9474211f5...4b.dll

windows7-x64

10

c9474211f5...4b.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c9474211f56a7a451e67a00a9ba712c4bfa9ebc2a12c71b3af18a9b9078f424b

  • Size

    2.6MB

  • Sample

    230823-gmxdxaab94

  • MD5

    453b062f5a467c61ba1bd17e47bedb32

  • SHA1

    0024333981286eb10fe482adbf5ef17df01fe4f4

  • SHA256

    c9474211f56a7a451e67a00a9ba712c4bfa9ebc2a12c71b3af18a9b9078f424b

  • SHA512

    78d619cd462b410303e38e2ed0fd2a4faab9086738bb1996b66c14976a6b4860117495af4967a8a6e98a3588ba8a4030913f2c9397b48304cdfa2e6043c39df4

  • SSDEEP

    49152:PeFQHevutBDJbIHiwCCCGXokhmP/Xx+6h/2+5Fa6R7Kpxe7MXlK0QmqKdFkY:Pee+vutFBoiwUIoD/Xx+6h/d5FaU7Kpb

Score
10/10
blackmoonbankerpersistencetrojanupx

Malware Config

Targets

    • Target

      c9474211f56a7a451e67a00a9ba712c4bfa9ebc2a12c71b3af18a9b9078f424b

    • Size

      2.6MB

    • MD5

      453b062f5a467c61ba1bd17e47bedb32

    • SHA1

      0024333981286eb10fe482adbf5ef17df01fe4f4

    • SHA256

      c9474211f56a7a451e67a00a9ba712c4bfa9ebc2a12c71b3af18a9b9078f424b

    • SHA512

      78d619cd462b410303e38e2ed0fd2a4faab9086738bb1996b66c14976a6b4860117495af4967a8a6e98a3588ba8a4030913f2c9397b48304cdfa2e6043c39df4

    • SSDEEP

      49152:PeFQHevutBDJbIHiwCCCGXokhmP/Xx+6h/2+5Fa6R7Kpxe7MXlK0QmqKdFkY:Pee+vutFBoiwUIoD/Xx+6h/d5FaU7Kpb

    Score
    10/10
    blackmoonbankerpersistencetrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Blocklisted process makes network request

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks