blackmoon | eeb7aaffb9a670853b633661cefeff3c378917be542499317f054e6bbb453403 | Triage

Submit
Reports

Overview

overview

Static

static

7

eeb7aaffb9...03.exe

windows7-x64

eeb7aaffb9...03.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

eeb7aaffb9a670853b633661cefeff3c378917be542499317f054e6bbb453403
Size

3.0MB
Sample

231115-s5x9psbh36
MD5

fdf6ed05bfedf93bd32ea6b1966a0d96
SHA1

30ce6087d244cc86a374d8aaa67bbd179c40e47e
SHA256

eeb7aaffb9a670853b633661cefeff3c378917be542499317f054e6bbb453403
SHA512

490854585a4d66973bd442acca3a326853cb66fedbaadd2dbb7412a21303cf379bf64a05a363e1e732377005b46814ff1f630e1082cacb107de0bc86a960ec11
SSDEEP

49152:np5w1+UZI4o0h11RXfHlbpRcv355xrz6iv6FkBt0bmOJTtyW/uhzEYLXCGLcv7H:WRZjh11Z/lbj6xrWiv6aB6bmO9tyW/oy

Score

10^/10

blackmoon aspackv2 banker trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

eeb7aaffb9a670853b633661cefeff3c378917be542499317f054e6bbb453403.exe

Resource

win7-20231020-en

blackmoon aspackv2 banker trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

eeb7aaffb9a670853b633661cefeff3c378917be542499317f054e6bbb453403.exe

Resource

win10v2004-20231023-en

blackmoon aspackv2 banker trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  eeb7aaffb9a670853b633661cefeff3c378917be542499317f054e6bbb453403
- Size
  
  3.0MB
- MD5
  
  fdf6ed05bfedf93bd32ea6b1966a0d96
- SHA1
  
  30ce6087d244cc86a374d8aaa67bbd179c40e47e
- SHA256
  
  eeb7aaffb9a670853b633661cefeff3c378917be542499317f054e6bbb453403
- SHA512
  
  490854585a4d66973bd442acca3a326853cb66fedbaadd2dbb7412a21303cf379bf64a05a363e1e732377005b46814ff1f630e1082cacb107de0bc86a960ec11
- SSDEEP
  
  49152:np5w1+UZI4o0h11RXfHlbpRcv355xrz6iv6FkBt0bmOJTtyW/uhzEYLXCGLcv7H:WRZjh11Z/lbj6xrWiv6aB6bmO9tyW/oy
Score

10^/10

blackmoon aspackv2 banker trojan
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonaspackv2bankertrojan

behavioral2

blackmoonaspackv2bankertrojan

© 2018-2025

Terms | Privacy