Overview

overview

10

Static

static

10

NEAS.54eb4...00.exe

windows7-x64

10

NEAS.54eb4...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.54eb49da10b9601e661b7ff956d32f00.exe

  • Size

    437KB

  • Sample

    231016-wzgasadd7x

  • MD5

    54eb49da10b9601e661b7ff956d32f00

  • SHA1

    5797679aa5e2fd410c57f7fb588936bf0b231aeb

  • SHA256

    f58e60929f6d99bf32f4943343621b9b1031641dbad066aafed77ec57a9bc2d5

  • SHA512

    5a3f509776654c5f3ba6540e8752bf75df178f3dc04ccb2adc4cf802cfbcec56c1afcc258a97999281cf9133e3e19e932a13a735b0cf07247f67026e5093adb5

  • SSDEEP

    6144:5fweR7gpANB0sv2YYuwfDoOPV1x0GwYpk09RhyQ3Zm6:J1R7gpAwsuvDNP/xyqk09TyCc6

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      NEAS.54eb49da10b9601e661b7ff956d32f00.exe

    • Size

      437KB

    • MD5

      54eb49da10b9601e661b7ff956d32f00

    • SHA1

      5797679aa5e2fd410c57f7fb588936bf0b231aeb

    • SHA256

      f58e60929f6d99bf32f4943343621b9b1031641dbad066aafed77ec57a9bc2d5

    • SHA512

      5a3f509776654c5f3ba6540e8752bf75df178f3dc04ccb2adc4cf802cfbcec56c1afcc258a97999281cf9133e3e19e932a13a735b0cf07247f67026e5093adb5

    • SSDEEP

      6144:5fweR7gpANB0sv2YYuwfDoOPV1x0GwYpk09RhyQ3Zm6:J1R7gpAwsuvDNP/xyqk09TyCc6

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks