Overview

overview

10

Static

static

10

e76f9b6958...28.exe

windows7-x64

10

e76f9b6958...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e76f9b6958fca510d682943b4234893a0e4a8d81d75c8c30aac38e5a916f1428.exe

  • Size

    366KB

  • Sample

    240409-ystzeacd7v

  • MD5

    a0307df6eb0b3cce819ad6a5894c08ee

  • SHA1

    13725598a9d292256bc6321bf8abeb2220e479c7

  • SHA256

    e76f9b6958fca510d682943b4234893a0e4a8d81d75c8c30aac38e5a916f1428

  • SHA512

    ba9a10f71653d4a5365db9168a4e2939d10b4e6ec9ef4fd908a288561d20297c819b1bdb4b673113099b07c522fe8d0637a91a160034bdd392e2f666e8bd6a3a

  • SSDEEP

    6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1p:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1p

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      e76f9b6958fca510d682943b4234893a0e4a8d81d75c8c30aac38e5a916f1428.exe

    • Size

      366KB

    • MD5

      a0307df6eb0b3cce819ad6a5894c08ee

    • SHA1

      13725598a9d292256bc6321bf8abeb2220e479c7

    • SHA256

      e76f9b6958fca510d682943b4234893a0e4a8d81d75c8c30aac38e5a916f1428

    • SHA512

      ba9a10f71653d4a5365db9168a4e2939d10b4e6ec9ef4fd908a288561d20297c819b1bdb4b673113099b07c522fe8d0637a91a160034bdd392e2f666e8bd6a3a

    • SSDEEP

      6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1p:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1p

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks