Overview

overview

10

Static

static

10

c2a63e201c...18.exe

windows7-x64

10

c2a63e201c...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c2a63e201c604e65f66f53a8718f95a2_JaffaCakes118

  • Size

    559KB

  • Sample

    240404-ztxx5aac5t

  • MD5

    c2a63e201c604e65f66f53a8718f95a2

  • SHA1

    9de7331de57f6c0df6a5162b1e5f7bc11c42b714

  • SHA256

    e578ece9d42ad3675227135b2e33a9051d4a74c685e0f9c52c45bda1de0f7979

  • SHA512

    1d3ac2027d9194f8b6c2e66f1802ec60a40d84da203f931f52c8df8fe2f98400ffe5c877b535bd73a73f233f3ac2cb323be455fcf5049c987d5297f7d39613a8

  • SSDEEP

    12288:fqGKl6bcNQSjEgkSiP8Lr2mFE66kjlKuJ9J7tfg+LRZq01Y:fNKl6b8JYgyP8WTGIuhZvPq

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      c2a63e201c604e65f66f53a8718f95a2_JaffaCakes118

    • Size

      559KB

    • MD5

      c2a63e201c604e65f66f53a8718f95a2

    • SHA1

      9de7331de57f6c0df6a5162b1e5f7bc11c42b714

    • SHA256

      e578ece9d42ad3675227135b2e33a9051d4a74c685e0f9c52c45bda1de0f7979

    • SHA512

      1d3ac2027d9194f8b6c2e66f1802ec60a40d84da203f931f52c8df8fe2f98400ffe5c877b535bd73a73f233f3ac2cb323be455fcf5049c987d5297f7d39613a8

    • SSDEEP

      12288:fqGKl6bcNQSjEgkSiP8Lr2mFE66kjlKuJ9J7tfg+LRZq01Y:fNKl6b8JYgyP8WTGIuhZvPq

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks