Overview

overview

10

Static

static

10

96445ae765...05.exe

windows7-x64

10

96445ae765...05.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0752d84e835a2125c3c0ee284404b4e9c401156c36a37ac7f0d9abc1250eb779

  • Size

    121KB

  • Sample

    240417-py7m1sff49

  • MD5

    895ed5f5c93f626ae44ff9e2e37a00a8

  • SHA1

    05ed7536430eda4f260b19574192c1643b6a555a

  • SHA256

    0752d84e835a2125c3c0ee284404b4e9c401156c36a37ac7f0d9abc1250eb779

  • SHA512

    63649ca90820035f34be02f9e422d63240f6ef142a9170bafdbe8c7d49ec00b60ac213b633927e7bcb088f4a73a6846f7d074162ea4b580999c5093f13f2416b

  • SSDEEP

    3072:dvNTN37ym4CiC3I6p/7y0GzFSwuHEWmHTS3aJsqsJE8+Joa:dH7yi5p/7y0Gz0w8sSKJyH+Jl

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      96445ae765d1c9ef741b1987aab10b316fe12d11d7579ec237a0bb221df6f605.exe

    • Size

      452KB

    • MD5

      07c286fc278d5b87fa2510cbc50691dd

    • SHA1

      b4c0166d681b26a44bfd4f18c8a1519d8707f6de

    • SHA256

      96445ae765d1c9ef741b1987aab10b316fe12d11d7579ec237a0bb221df6f605

    • SHA512

      d9b3ad65bb1748657b3d361eb64cd573865c95c70982552155a6a410f57b37a8038ebfe6a6366ad6a764ac9916c5bc1f6719985639569fed974de552f2546117

    • SSDEEP

      6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZJ:/vpv/R6H3U25fehHpAW+yOBOKCZJ

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks