Overview

overview

10

Static

static

10

c327bf1c69...24.exe

windows7-x64

10

c327bf1c69...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c327bf1c696f347a588b06dfad6bf93bf2b1a5a4bd71bb0ee8a93dcf61151b24

  • Size

    10.6MB

  • Sample

    231126-l2766sgg2z

  • MD5

    fc67886445ee161ea074e983ed87711a

  • SHA1

    16355b16649f046276de1ff4b1f09849263fbe71

  • SHA256

    c327bf1c696f347a588b06dfad6bf93bf2b1a5a4bd71bb0ee8a93dcf61151b24

  • SHA512

    4660dd31ec7097758f8b78fe13d581892ea8439dd7cf926097d7dba0b6952af54c503c95c1195764972fa14e49865e35b6b1c5c0b1a4611cf0a7e560e1920782

  • SSDEEP

    196608:OBOtbQ6JVjP93izWhcSIIMSfpV4b653gsAaGEoXM8:OBOtbQ6zFyyMSxVeegsGEIM8

Score
10/10
blackmoonbankertrojanvmprotect

Malware Config

Targets

    • Target

      c327bf1c696f347a588b06dfad6bf93bf2b1a5a4bd71bb0ee8a93dcf61151b24

    • Size

      10.6MB

    • MD5

      fc67886445ee161ea074e983ed87711a

    • SHA1

      16355b16649f046276de1ff4b1f09849263fbe71

    • SHA256

      c327bf1c696f347a588b06dfad6bf93bf2b1a5a4bd71bb0ee8a93dcf61151b24

    • SHA512

      4660dd31ec7097758f8b78fe13d581892ea8439dd7cf926097d7dba0b6952af54c503c95c1195764972fa14e49865e35b6b1c5c0b1a4611cf0a7e560e1920782

    • SSDEEP

      196608:OBOtbQ6JVjP93izWhcSIIMSfpV4b653gsAaGEoXM8:OBOtbQ6zFyyMSxVeegsGEIM8

    Score
    10/10
    blackmoonbankertrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks