blackmoon | 02e56419a9847617fc1d06986a9e15e4745382e4751f86eef38fd0b18213e913 | Triage

Submit
Reports

Overview

overview

Static

static

7

02e56419a9...13.exe

windows7-x64

02e56419a9...13.exe

windows10-2004-x64

Sharing

General

Target

02e56419a9847617fc1d06986a9e15e4745382e4751f86eef38fd0b18213e913
Size

669KB
Sample

231117-vg6x2sbd67
MD5

6db4cf045db764c86c46d0927004452f
SHA1

ab4610d93d816d2c0a3405a46705a68d2ce7217b
SHA256

02e56419a9847617fc1d06986a9e15e4745382e4751f86eef38fd0b18213e913
SHA512

237e4ed7b469be3ad0a45d53d72382f119ce69e0e6eb517ebc4d90a328c872c44b89b63fda645f080e0dddd1222598efd27c832ad67be4d4f711346fe6c53834
SSDEEP

6144:LJSOPxCO7zXO3j3DjRETcSa/9vfNZeCI6y73CXeAReUUMiDVxj0q/:7Te3RtSaLMCI6y7ZARexEq

Score

10^/10

blackmoon gh0strat aspackv2 banker persistence rat trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

02e56419a9847617fc1d06986a9e15e4745382e4751f86eef38fd0b18213e913.exe

Resource

win7-20231025-en

blackmoon gh0strat banker persistence rat trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

02e56419a9847617fc1d06986a9e15e4745382e4751f86eef38fd0b18213e913.exe

Resource

win10v2004-20231023-en

blackmoon banker persistence trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  02e56419a9847617fc1d06986a9e15e4745382e4751f86eef38fd0b18213e913
- Size
  
  669KB
- MD5
  
  6db4cf045db764c86c46d0927004452f
- SHA1
  
  ab4610d93d816d2c0a3405a46705a68d2ce7217b
- SHA256
  
  02e56419a9847617fc1d06986a9e15e4745382e4751f86eef38fd0b18213e913
- SHA512
  
  237e4ed7b469be3ad0a45d53d72382f119ce69e0e6eb517ebc4d90a328c872c44b89b63fda645f080e0dddd1222598efd27c832ad67be4d4f711346fe6c53834
- SSDEEP
  
  6144:LJSOPxCO7zXO3j3DjRETcSa/9vfNZeCI6y73CXeAReUUMiDVxj0q/:7Te3RtSaLMCI6y7ZARexEq
Score

10^/10

blackmoon gh0strat banker persistence rat trojan
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoongh0stratbankerpersistencerattrojan

behavioral2

blackmoonbankerpersistencetrojan

© 2018-2025

Terms | Privacy