Overview

overview

10

Static

static

10

030d5d1977...d6.exe

windows7-x64

10

030d5d1977...d6.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    030d5d197784ee0df38f139891ba73ae81eba0d2c77d802d05d958dd5a8cbed6.exe

  • Size

    436KB

  • Sample

    240410-bdn4aabc39

  • MD5

    8617d30760c7c362d1668d4d9726fed2

  • SHA1

    ac74fad2b579978f4560514e3cb995a6c26bbe6f

  • SHA256

    030d5d197784ee0df38f139891ba73ae81eba0d2c77d802d05d958dd5a8cbed6

  • SHA512

    d61886aa54d861bd76958c119547d519c428621a6497aaed4e0d9a035134c5c957a8f32323b2af68306c2d0ce46b2fb5a09a4b630e611bb15a37a6713bdd7880

  • SSDEEP

    3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/0/yjUuMx8k7:q0m2FqgDAuSbAXKfz0c0sUIJHk40/yWP

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      030d5d197784ee0df38f139891ba73ae81eba0d2c77d802d05d958dd5a8cbed6.exe

    • Size

      436KB

    • MD5

      8617d30760c7c362d1668d4d9726fed2

    • SHA1

      ac74fad2b579978f4560514e3cb995a6c26bbe6f

    • SHA256

      030d5d197784ee0df38f139891ba73ae81eba0d2c77d802d05d958dd5a8cbed6

    • SHA512

      d61886aa54d861bd76958c119547d519c428621a6497aaed4e0d9a035134c5c957a8f32323b2af68306c2d0ce46b2fb5a09a4b630e611bb15a37a6713bdd7880

    • SSDEEP

      3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/0/yjUuMx8k7:q0m2FqgDAuSbAXKfz0c0sUIJHk40/yWP

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks