blackmoon | ff424f6a0e9ba120de7d7c40df0f3d39e4e1d95fd36c93bcf400c34a58b1f00c | Triage

Submit
Reports

Overview

overview

Static

static

ff424f6a0e...0c.exe

windows7-x64

ff424f6a0e...0c.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

ff424f6a0e9ba120de7d7c40df0f3d39e4e1d95fd36c93bcf400c34a58b1f00c
Size

436KB
Sample

240308-clf83sce87
MD5

7bc999e813c940a85d8be34fbad4e383
SHA1

eddd6e8981cfc70b639071a5e0c2d6da178e6b55
SHA256

ff424f6a0e9ba120de7d7c40df0f3d39e4e1d95fd36c93bcf400c34a58b1f00c
SHA512

3ccb88049a2bdb94a5e8513254eb064a084b20d908516f634e792d47b951854ec500dd50476ab315249c554582982b981fd979214721f6b816723ff9338fc10c
SSDEEP

6144:dGdR+Yk/N8duBmG6t+UnRsRCQ/OJZOg72:doR+Y4NSG6oUnRsdOJZOg72

Score

10^/10

blackmoon banker trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

ff424f6a0e9ba120de7d7c40df0f3d39e4e1d95fd36c93bcf400c34a58b1f00c.exe

Resource

win7-20240220-en

blackmoon banker trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

ff424f6a0e9ba120de7d7c40df0f3d39e4e1d95fd36c93bcf400c34a58b1f00c.exe

Resource

win10v2004-20240226-en

blackmoon banker trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  ff424f6a0e9ba120de7d7c40df0f3d39e4e1d95fd36c93bcf400c34a58b1f00c
- Size
  
  436KB
- MD5
  
  7bc999e813c940a85d8be34fbad4e383
- SHA1
  
  eddd6e8981cfc70b639071a5e0c2d6da178e6b55
- SHA256
  
  ff424f6a0e9ba120de7d7c40df0f3d39e4e1d95fd36c93bcf400c34a58b1f00c
- SHA512
  
  3ccb88049a2bdb94a5e8513254eb064a084b20d908516f634e792d47b951854ec500dd50476ab315249c554582982b981fd979214721f6b816723ff9338fc10c
- SSDEEP
  
  6144:dGdR+Yk/N8duBmG6t+UnRsRCQ/OJZOg72:doR+Y4NSG6oUnRsdOJZOg72
Score

10^/10

blackmoon banker trojan
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankertrojan

behavioral2

blackmoonbankertrojan

© 2018-2025

Terms | Privacy