Overview

overview

10

Static

static

10

4b277416df...3b.exe

windows7-x64

7

4b277416df...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b277416dfaec448fe46c00bbfd7452fc39088b950db1e726afc7a0e21e6133b

  • Size

    276KB

  • Sample

    240418-q3nalseg82

  • MD5

    4672d9ec8afed68730dbacf37313bbe9

  • SHA1

    cddbaa96e181edc6ed29a347e72da58f4b4321f0

  • SHA256

    4b277416dfaec448fe46c00bbfd7452fc39088b950db1e726afc7a0e21e6133b

  • SHA512

    8d341ba5d88fcceeb9a2c69249a7609c002fbc03e44dc465fb437dc5f1b2de26e21c10565ccfe94505b6ba987367f7bbad69c9b7cd7213c940c98b9fe20d728b

  • SSDEEP

    6144:0f2nHpwQwbzfo5QH2NYcr0rTNQ3wwVVBEsR2:0f2nHpwQwbzw5QH2Z0rhQA+B

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      4b277416dfaec448fe46c00bbfd7452fc39088b950db1e726afc7a0e21e6133b

    • Size

      276KB

    • MD5

      4672d9ec8afed68730dbacf37313bbe9

    • SHA1

      cddbaa96e181edc6ed29a347e72da58f4b4321f0

    • SHA256

      4b277416dfaec448fe46c00bbfd7452fc39088b950db1e726afc7a0e21e6133b

    • SHA512

      8d341ba5d88fcceeb9a2c69249a7609c002fbc03e44dc465fb437dc5f1b2de26e21c10565ccfe94505b6ba987367f7bbad69c9b7cd7213c940c98b9fe20d728b

    • SSDEEP

      6144:0f2nHpwQwbzfo5QH2NYcr0rTNQ3wwVVBEsR2:0f2nHpwQwbzw5QH2Z0rhQA+B

    Score
    10/10
    upxblackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks