Overview

overview

10

Static

static

3

HEUR-Trojan.Win32.exe

windows7-x64

HEUR-Trojan.Win32.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    HEUR-Trojan.Win32.Generic-6ea395cebcd05aea1e77113e85fa4d778794d3e684359919869055a01064791a

  • Size

    333KB

  • Sample

    240229-jn1h3aag31

  • MD5

    e432e0f4d564f26b9d19f8c745a9b9cd

  • SHA1

    b9ff8c54841c27957a4bba9a4117acfdac01b048

  • SHA256

    6ea395cebcd05aea1e77113e85fa4d778794d3e684359919869055a01064791a

  • SHA512

    89492816d88acc5b43ac1d1eb12bbd043defbd9d12cc8236878422fec31902984541f9e17cdf8b152632564d53ade6d1fa2a9968e2f8e20de03cd39f1b4a3130

  • SSDEEP

    3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqnuOeHzmB600TUA6Z7zupc+BA:n3C9BRo7tvnJ99T/KZEuOod00TG+BA

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      HEUR-Trojan.Win32.Generic-6ea395cebcd05aea1e77113e85fa4d778794d3e684359919869055a01064791a

    • Size

      333KB

    • MD5

      e432e0f4d564f26b9d19f8c745a9b9cd

    • SHA1

      b9ff8c54841c27957a4bba9a4117acfdac01b048

    • SHA256

      6ea395cebcd05aea1e77113e85fa4d778794d3e684359919869055a01064791a

    • SHA512

      89492816d88acc5b43ac1d1eb12bbd043defbd9d12cc8236878422fec31902984541f9e17cdf8b152632564d53ade6d1fa2a9968e2f8e20de03cd39f1b4a3130

    • SSDEEP

      3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqnuOeHzmB600TUA6Z7zupc+BA:n3C9BRo7tvnJ99T/KZEuOod00TG+BA

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks