blackmoon | ded50245639dbd5274f2a117987aa005d9190439c64a1547584dfc7209ea6b5d

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 16:50

Target

NEAS.ded50245639dbd5274f2a117987aa005d9190439c64a1547584dfc7209ea6b5d_JC.exe
Size

1.8MB
MD5

df63cf286225e93aa27c746d859bb894
SHA1

5a8060da4b2670a81bf355afc3a1d1f35fdf5f08
SHA256

ded50245639dbd5274f2a117987aa005d9190439c64a1547584dfc7209ea6b5d
SHA512

52266de8f4e24e2a4d5161d54cfbc332abcc4f27549a0553e37acd3c6e647b7d8bad6b0f08a04a4a66a29d78dd1d855208a2ea346492097a38d67982e2e3f8d6
SSDEEP

49152:xV1vBMW7JgP8ZPfWXGaj0ro6XrfrBVVPUo:X1vGSDGHirfrB3co

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/2576-3-0x0000000000400000-0x0000000000876000-memory.dmp	family_blackmoon

C:\Users\Admin\AppData\Local\Temp\NEAS.ded50245639dbd5274f2a117987aa005d9190439c64a1547584dfc7209ea6b5d_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ded50245639dbd5274f2a117987aa005d9190439c64a1547584dfc7209ea6b5d_JC.exe"
1⤵
PID:2576

memory/2576-0-0x0000000000400000-0x0000000000876000-memory.dmp

Filesize
4.5MB

Download
memory/2576-1-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2576-2-0x0000000010000000-0x00000000101A1000-memory.dmp

Filesize
1.6MB

Download
memory/2576-3-0x0000000000400000-0x0000000000876000-memory.dmp

Filesize
4.5MB

Download
memory/2576-4-0x0000000010000000-0x00000000101A1000-memory.dmp

Filesize
1.6MB

Download