Overview

overview

10

Static

static

7

29268d0cd8...37.exe

windows7-x64

10

29268d0cd8...37.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837

  • Size

    13.1MB

  • Sample

    231226-sgmhascce4

  • MD5

    744c2727bd6be3851d2510b239703569

  • SHA1

    fcfae2bf675feb13ea6c3982ef4d76048ba6b072

  • SHA256

    29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837

  • SHA512

    d6bcfc48348052488747d767c75f7d666b727b64ca5aad3cc86d5688b73f7e1a5e720a02aeca0705d7e00cfa82cc2619050ff0213cf19a7768e19d6856180172

  • SSDEEP

    393216:6dAiIq9yVYbXUfuq5PJloo6T8SwOy3GoBF:ZGyVYbXUmlbT8SwIG

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837

    • Size

      13.1MB

    • MD5

      744c2727bd6be3851d2510b239703569

    • SHA1

      fcfae2bf675feb13ea6c3982ef4d76048ba6b072

    • SHA256

      29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837

    • SHA512

      d6bcfc48348052488747d767c75f7d666b727b64ca5aad3cc86d5688b73f7e1a5e720a02aeca0705d7e00cfa82cc2619050ff0213cf19a7768e19d6856180172

    • SSDEEP

      393216:6dAiIq9yVYbXUfuq5PJloo6T8SwOy3GoBF:ZGyVYbXUmlbT8SwIG

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks