Overview

overview

10

Static

static

10

a2aa2e6b04...6c.exe

windows7-x64

10

a2aa2e6b04...6c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a2aa2e6b0447a3aad1a3aa6fa6d9bab321b11444757b1ca8a1e7f09d1443166c

  • Size

    1.1MB

  • Sample

    230828-eg214afd82

  • MD5

    9d45e945a60842b9604400b50f4a4df3

  • SHA1

    c6612b36b852a2cf0b599ee3758a80da99d860b9

  • SHA256

    a2aa2e6b0447a3aad1a3aa6fa6d9bab321b11444757b1ca8a1e7f09d1443166c

  • SHA512

    e02a509d07da7040f14293dc086f2eab9f89e415868be1019881ed4720adc24b48b5a4ae96531b8693d9a601324ee9bb1dc83e32373ef727214b9c7b66888226

  • SSDEEP

    24576:l85qKmpmYZeU4Urece8rVGCzHutX79kR9T4J9:leYZx4UrecfRCtX7q3T4

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      a2aa2e6b0447a3aad1a3aa6fa6d9bab321b11444757b1ca8a1e7f09d1443166c

    • Size

      1.1MB

    • MD5

      9d45e945a60842b9604400b50f4a4df3

    • SHA1

      c6612b36b852a2cf0b599ee3758a80da99d860b9

    • SHA256

      a2aa2e6b0447a3aad1a3aa6fa6d9bab321b11444757b1ca8a1e7f09d1443166c

    • SHA512

      e02a509d07da7040f14293dc086f2eab9f89e415868be1019881ed4720adc24b48b5a4ae96531b8693d9a601324ee9bb1dc83e32373ef727214b9c7b66888226

    • SSDEEP

      24576:l85qKmpmYZeU4Urece8rVGCzHutX79kR9T4J9:leYZx4UrecfRCtX7q3T4

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks