Overview

overview

10

Static

static

10

9df901aa00...41.exe

windows7-x64

10

9df901aa00...41.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5239ba56ef2f39b1da523e804f33625.bin

  • Size

    125KB

  • Sample

    240411-b8femacc7t

  • MD5

    6fee12d758108af953b26defbf2b9efb

  • SHA1

    7dcaf8edc3018e0ba595b0dd33bdaf588a7e6586

  • SHA256

    d3a8f30a8ca6996b02163d1badd044b9d357f81864d012203203d65daa6f87c3

  • SHA512

    0c65dc36643766ffec47c2cf240e8d217e17158b4465bd73ec08a1ed16da9cef5a04d0ee163e60b026a0e0a9acc3ee54ba1f3ed330c94e6f8b4f46422b7d7bdc

  • SSDEEP

    3072:KGvRxIyhnhrQX0CK3M4/Y8x4KaxopPdjMs6/OQ0JD:KgfIQU0ZZzxWOpVAs6H0V

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      9df901aa003bd47016ef7976233bcfbc63a7f74a21537a38498110cdf1955341.exe

    • Size

      440KB

    • MD5

      d5239ba56ef2f39b1da523e804f33625

    • SHA1

      a9399024792609e7943c95a5e7b61c75255606e4

    • SHA256

      9df901aa003bd47016ef7976233bcfbc63a7f74a21537a38498110cdf1955341

    • SHA512

      ce4257251920599a88e67f36d91585c9b58ba2d7a40023bb35b28241b01752b98afcf569e7777b0fed5a9512d09e15fbc648518b7c6cf2656e68024c1e4e6288

    • SSDEEP

      6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAn:xgXQKSLpOCtV0R8xMSaAn

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks