Overview

overview

10

Static

static

10

NEAS.ae030...70.exe

windows7-x64

10

NEAS.ae030...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.ae030bc8bfc938883355b2b567858c70.exe

  • Size

    92KB

  • Sample

    231016-w64dwsbc32

  • MD5

    ae030bc8bfc938883355b2b567858c70

  • SHA1

    b2ed46153217993f83241154be9cbb43b7d7f0fe

  • SHA256

    cf4f8546496409071b8b1bf0686c809b8eab3228098fed0521f10568fef2f260

  • SHA512

    591dfa011428febeebc82d75170771309277a6e88d9fd4d9cf70f71d7ffcee4833d3d99afafe3a95c5a2bf711dde4d16541358e5e7f4d06f8ea2a65d3099b9d6

  • SSDEEP

    1536:l9EJv7qMinKldu6OpZz5CUTDb3zKg+GinF3BHEB7L6J8usIGpxIVUlbRI:0Jv7MK+6KZb3zvcndBoqJ8usLpxHW

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      NEAS.ae030bc8bfc938883355b2b567858c70.exe

    • Size

      92KB

    • MD5

      ae030bc8bfc938883355b2b567858c70

    • SHA1

      b2ed46153217993f83241154be9cbb43b7d7f0fe

    • SHA256

      cf4f8546496409071b8b1bf0686c809b8eab3228098fed0521f10568fef2f260

    • SHA512

      591dfa011428febeebc82d75170771309277a6e88d9fd4d9cf70f71d7ffcee4833d3d99afafe3a95c5a2bf711dde4d16541358e5e7f4d06f8ea2a65d3099b9d6

    • SSDEEP

      1536:l9EJv7qMinKldu6OpZz5CUTDb3zKg+GinF3BHEB7L6J8usIGpxIVUlbRI:0Jv7MK+6KZb3zvcndBoqJ8usLpxHW

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks