Overview

overview

10

Static

static

3

218b9a39a1...bf.exe

windows7-x64

10

218b9a39a1...bf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    218b9a39a157bc200e3bc0b28f99c6bf

  • Size

    128KB

  • Sample

    231225-qnq3ysaacr

  • MD5

    218b9a39a157bc200e3bc0b28f99c6bf

  • SHA1

    2259bcf24387279012a3c194a8c6eb0d21d5e7bd

  • SHA256

    7e6a8e3801e87e6d392b0826b21bdffa0bdef5c67476b48427171bb9c992b31c

  • SHA512

    d6c0b0f0af47f9cf9edfb78969a074e231c5312ac40e248e18db9ad0be96c1ca4dfe4f693014787629bb2641d4b16ed66622c4d83cdd14ded079dbf368ac603a

  • SSDEEP

    3072:0gUq9GDx++6rIsbT4qOg41v2dYeVUknnzBbMqds6NoutZ:0Tq9G0+LwTODt2meVnnnlb7/oSZ

Score
10/10
blackmoonbankerpersistencetrojanvmprotect

Malware Config

Targets

    • Target

      218b9a39a157bc200e3bc0b28f99c6bf

    • Size

      128KB

    • MD5

      218b9a39a157bc200e3bc0b28f99c6bf

    • SHA1

      2259bcf24387279012a3c194a8c6eb0d21d5e7bd

    • SHA256

      7e6a8e3801e87e6d392b0826b21bdffa0bdef5c67476b48427171bb9c992b31c

    • SHA512

      d6c0b0f0af47f9cf9edfb78969a074e231c5312ac40e248e18db9ad0be96c1ca4dfe4f693014787629bb2641d4b16ed66622c4d83cdd14ded079dbf368ac603a

    • SSDEEP

      3072:0gUq9GDx++6rIsbT4qOg41v2dYeVUknnzBbMqds6NoutZ:0Tq9G0+LwTODt2meVnnnlb7/oSZ

    Score
    10/10
    blackmoonbankerpersistencetrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Drops file in Drivers directory

    • Modifies AppInit DLL entries

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks