blackmoon | 8dfd7bc1ea6c8f48de5b3cf49dbe57ab5add8df38d9d895950cf74b120b1053c | Triage

Submit
Reports

Overview

overview

Static

static

7

8dfd7bc1ea...3c.exe

windows7-x64

8dfd7bc1ea...3c.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

8dfd7bc1ea6c8f48de5b3cf49dbe57ab5add8df38d9d895950cf74b120b1053c
Size

290KB
Sample

240225-sy7jssff5y
MD5

d1ec6cc040454173bbca6d6ff99e8ecf
SHA1

72a816366ea3180182a32259f82a66572cb7a0ce
SHA256

8dfd7bc1ea6c8f48de5b3cf49dbe57ab5add8df38d9d895950cf74b120b1053c
SHA512

a56992f9bbab72d48d9af7b54ff2cbada6f6c75cbae8f3e56966eeeffabf23520b227bd53c68281da773bbe67610b4b6501a0cac36d5b1bf53fe1b8ab90097ae
SSDEEP

6144:jl1RTHcqtwVZaw3uu0gEpA4yS+XYMupzKTch6hsZMaYfs/jYleslpPoS:jlvFKa+uTgPhSXMu+hhBaYfsieAoS

Score

10^/10

blackmoon banker persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

8dfd7bc1ea6c8f48de5b3cf49dbe57ab5add8df38d9d895950cf74b120b1053c.exe

Resource

win7-20240221-en

blackmoon banker trojan upx

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

8dfd7bc1ea6c8f48de5b3cf49dbe57ab5add8df38d9d895950cf74b120b1053c.exe

Resource

win10v2004-20240221-en

blackmoon banker persistence trojan upx

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  8dfd7bc1ea6c8f48de5b3cf49dbe57ab5add8df38d9d895950cf74b120b1053c
- Size
  
  290KB
- MD5
  
  d1ec6cc040454173bbca6d6ff99e8ecf
- SHA1
  
  72a816366ea3180182a32259f82a66572cb7a0ce
- SHA256
  
  8dfd7bc1ea6c8f48de5b3cf49dbe57ab5add8df38d9d895950cf74b120b1053c
- SHA512
  
  a56992f9bbab72d48d9af7b54ff2cbada6f6c75cbae8f3e56966eeeffabf23520b227bd53c68281da773bbe67610b4b6501a0cac36d5b1bf53fe1b8ab90097ae
- SSDEEP
  
  6144:jl1RTHcqtwVZaw3uu0gEpA4yS+XYMupzKTch6hsZMaYfs/jYleslpPoS:jlvFKa+uTgPhSXMu+hhBaYfsieAoS
Score

10^/10

blackmoon banker trojan upx persistence
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankertrojanupx

behavioral2

blackmoonbankerpersistencetrojanupx

© 2018-2025

Terms | Privacy