General

  • Target

    c8b001eb77613501456404f50d6e6758dee17f9dc18f659720280d621dfb4ee6

  • Size

    11.8MB

  • Sample

    240407-tsykdage8v

  • MD5

    6e3caa65b08873e32c96a590a32f2133

  • SHA1

    10fb1bba0e379cf40462d8cd94d829310c31fd77

  • SHA256

    c8b001eb77613501456404f50d6e6758dee17f9dc18f659720280d621dfb4ee6

  • SHA512

    de6f97da36e1ab6fb5e7555c601353a3b7d792cba0fff192169bfaceec5d86a28b8b31d44631f80e1e5f77521f4ce3f867497f10f9b51e3838190d9f719a1026

  • SSDEEP

    196608:hIJ6eA5cPmiRqfk0ScX/eBDv+cRc7A4Yn7WILy+aEkcGXe6bqmOIhJZEFIxgabSs:hf1xAcX/Or/M07neRJXe6basrSsgabI4

Malware Config

Targets

    • Target

      c8b001eb77613501456404f50d6e6758dee17f9dc18f659720280d621dfb4ee6

    • Size

      11.8MB

    • MD5

      6e3caa65b08873e32c96a590a32f2133

    • SHA1

      10fb1bba0e379cf40462d8cd94d829310c31fd77

    • SHA256

      c8b001eb77613501456404f50d6e6758dee17f9dc18f659720280d621dfb4ee6

    • SHA512

      de6f97da36e1ab6fb5e7555c601353a3b7d792cba0fff192169bfaceec5d86a28b8b31d44631f80e1e5f77521f4ce3f867497f10f9b51e3838190d9f719a1026

    • SSDEEP

      196608:hIJ6eA5cPmiRqfk0ScX/eBDv+cRc7A4Yn7WILy+aEkcGXe6bqmOIhJZEFIxgabSs:hf1xAcX/Or/M07neRJXe6basrSsgabI4

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Sets desktop wallpaper using registry

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks