Overview

overview

10

Static

static

10

0583ebc9bf...d5.exe

windows7-x64

10

0583ebc9bf...d5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0583ebc9bf54d69ed6bc2e5b0c4528d5

  • Size

    87KB

  • Sample

    231229-2ak6bsdcam

  • MD5

    0583ebc9bf54d69ed6bc2e5b0c4528d5

  • SHA1

    96af47bd70de54632925abed7e3ef1b1cee30375

  • SHA256

    94262563de63c27fde065b5ed118c0d13149e660f4bd00bf17ab5a0fa9cf4e72

  • SHA512

    3ed6ad0e1894203eebf212403ce47294e2cd512606449e4a2b45077ca88758275dcd6a5ed6da96d352102c8dbfe6cd82f7690f3c82b2b771ba6c32bbe6e459fb

  • SSDEEP

    1536:GtyyRF/OxmfzDcazhe2hb5nnW+ME9Sf2+pg9R8LxM8WkNK+tEf6uacK:7yTtfbo2nWW982+paS9pWkNxXuW

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      0583ebc9bf54d69ed6bc2e5b0c4528d5

    • Size

      87KB

    • MD5

      0583ebc9bf54d69ed6bc2e5b0c4528d5

    • SHA1

      96af47bd70de54632925abed7e3ef1b1cee30375

    • SHA256

      94262563de63c27fde065b5ed118c0d13149e660f4bd00bf17ab5a0fa9cf4e72

    • SHA512

      3ed6ad0e1894203eebf212403ce47294e2cd512606449e4a2b45077ca88758275dcd6a5ed6da96d352102c8dbfe6cd82f7690f3c82b2b771ba6c32bbe6e459fb

    • SSDEEP

      1536:GtyyRF/OxmfzDcazhe2hb5nnW+ME9Sf2+pg9R8LxM8WkNK+tEf6uacK:7yTtfbo2nWW982+paS9pWkNxXuW

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks