Overview

overview

10

Static

static

3

a1a9d68c83...28.exe

windows7-x64

10

a1a9d68c83...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1a9d68c83475e6517ffafb3c8bdafb05956dd264796dbde17a15c1bac903928

  • Size

    445KB

  • Sample

    240411-bh3r8sbc3y

  • MD5

    faa298a67d7fc996a99f994c30f281f1

  • SHA1

    7618d0f8f75777ab89f542a7443d1e8fb5fdf30c

  • SHA256

    a1a9d68c83475e6517ffafb3c8bdafb05956dd264796dbde17a15c1bac903928

  • SHA512

    d373b7f2c8334503ecbf52247807cba577b837a585b866d6cd8626078cecb7a049330b861ccd5648d7e97f86705d417d8f754d1e009fc75fa0edbcbdf459f267

  • SSDEEP

    6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09JO9:n3C9ytvn8whkb4i3e3GFO6JM

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      a1a9d68c83475e6517ffafb3c8bdafb05956dd264796dbde17a15c1bac903928

    • Size

      445KB

    • MD5

      faa298a67d7fc996a99f994c30f281f1

    • SHA1

      7618d0f8f75777ab89f542a7443d1e8fb5fdf30c

    • SHA256

      a1a9d68c83475e6517ffafb3c8bdafb05956dd264796dbde17a15c1bac903928

    • SHA512

      d373b7f2c8334503ecbf52247807cba577b837a585b866d6cd8626078cecb7a049330b861ccd5648d7e97f86705d417d8f754d1e009fc75fa0edbcbdf459f267

    • SSDEEP

      6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09JO9:n3C9ytvn8whkb4i3e3GFO6JM

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks