Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

a520fa28c6...a2.exe

windows7-x64

10

a520fa28c6...a2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a520fa28c62a821d17f059e6a2e06ffbcf6e65a5a5aa28dc72ebee42b46ffca2

  • Size

    2.9MB

  • Sample

    231012-f9mbsacc56

  • MD5

    e42d1929b5179466c176cf2bae29f899

  • SHA1

    c88ff0b920cf5c818b183f7166503ee2b7eadcdb

  • SHA256

    a520fa28c62a821d17f059e6a2e06ffbcf6e65a5a5aa28dc72ebee42b46ffca2

  • SHA512

    002346d8590da139ce7838a4fc20668a7a55773fd5faf9d4fe961a2dddd88033eba33cb1c54ffc6dd8ef038f1b65a92c7c1926060dfd0007625d57d4b8eeafa7

  • SSDEEP

    24576:pCKzARimQzNe4Za8iX5FfrVjePHS1Q2d7VITbSAcQwKXo58OKIbs5ffzxGtm3qzx:pCQ1I5uPHE9xWnFItf/BTJBaQPGdwn5

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      a520fa28c62a821d17f059e6a2e06ffbcf6e65a5a5aa28dc72ebee42b46ffca2

    • Size

      2.9MB

    • MD5

      e42d1929b5179466c176cf2bae29f899

    • SHA1

      c88ff0b920cf5c818b183f7166503ee2b7eadcdb

    • SHA256

      a520fa28c62a821d17f059e6a2e06ffbcf6e65a5a5aa28dc72ebee42b46ffca2

    • SHA512

      002346d8590da139ce7838a4fc20668a7a55773fd5faf9d4fe961a2dddd88033eba33cb1c54ffc6dd8ef038f1b65a92c7c1926060dfd0007625d57d4b8eeafa7

    • SSDEEP

      24576:pCKzARimQzNe4Za8iX5FfrVjePHS1Q2d7VITbSAcQwKXo58OKIbs5ffzxGtm3qzx:pCQ1I5uPHE9xWnFItf/BTJBaQPGdwn5

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks