Overview

overview

10

Static

static

10

57bee2fdfa...f9.exe

windows7-x64

10

57bee2fdfa...f9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    57bee2fdfa741b59ebdf0cee1ddf67d834db6e4340ae204fcd376f76c96d54f9

  • Size

    440KB

  • Sample

    240421-1t8kasca29

  • MD5

    1d35c35313b85f696d3396b30dea7a0a

  • SHA1

    0d6c88bf43c8da612e50968a07720e3912f3bbdf

  • SHA256

    57bee2fdfa741b59ebdf0cee1ddf67d834db6e4340ae204fcd376f76c96d54f9

  • SHA512

    4cd06395ac6e95770d729a4a3204e3e0b9bd29851cb0c7a644fdc6edc99b5bbf8b2340b5fe608a2e466f7c1edb68923c8f7c6dbdf0f9a756828184d36ae3492a

  • SSDEEP

    6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAK:xgXQKSLpOCtV0R8xMSaAK

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      57bee2fdfa741b59ebdf0cee1ddf67d834db6e4340ae204fcd376f76c96d54f9

    • Size

      440KB

    • MD5

      1d35c35313b85f696d3396b30dea7a0a

    • SHA1

      0d6c88bf43c8da612e50968a07720e3912f3bbdf

    • SHA256

      57bee2fdfa741b59ebdf0cee1ddf67d834db6e4340ae204fcd376f76c96d54f9

    • SHA512

      4cd06395ac6e95770d729a4a3204e3e0b9bd29851cb0c7a644fdc6edc99b5bbf8b2340b5fe608a2e466f7c1edb68923c8f7c6dbdf0f9a756828184d36ae3492a

    • SSDEEP

      6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAK:xgXQKSLpOCtV0R8xMSaAK

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks