Overview

overview

10

Static

static

7

f422242d47...e8.exe

windows7-x64

10

f422242d47...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f422242d47aac5e01bbdfbb5db0da1735b7cb70820a21f8c740a95d0d41284e8

  • Size

    840KB

  • Sample

    231102-lq97dscb72

  • MD5

    df073126cc1a49a6f617c421b2411443

  • SHA1

    eb4499dee0f068c2153ba7bfdc6f9a1df31915d3

  • SHA256

    f422242d47aac5e01bbdfbb5db0da1735b7cb70820a21f8c740a95d0d41284e8

  • SHA512

    ddda3a9a4fcc5d003f11dfea91e69414d30cdcc11fa35637ac7b4deffbc519f42812a54acab9767084d08d1876073138eb64be59b2da5a1413aa2ea6abfc459a

  • SSDEEP

    24576:x0n0W6Evw14G6Uukw5mR9Kqw1MaN7ADqZ:in0W6r44Cc9w1cDqZ

Score
10/10
blackmoonbankertrojanvmprotect

Malware Config

Targets

    • Target

      f422242d47aac5e01bbdfbb5db0da1735b7cb70820a21f8c740a95d0d41284e8

    • Size

      840KB

    • MD5

      df073126cc1a49a6f617c421b2411443

    • SHA1

      eb4499dee0f068c2153ba7bfdc6f9a1df31915d3

    • SHA256

      f422242d47aac5e01bbdfbb5db0da1735b7cb70820a21f8c740a95d0d41284e8

    • SHA512

      ddda3a9a4fcc5d003f11dfea91e69414d30cdcc11fa35637ac7b4deffbc519f42812a54acab9767084d08d1876073138eb64be59b2da5a1413aa2ea6abfc459a

    • SSDEEP

      24576:x0n0W6Evw14G6Uukw5mR9Kqw1MaN7ADqZ:in0W6r44Cc9w1cDqZ

    Score
    10/10
    blackmoonbankertrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks