blackmoon | ece34d78b747a27cefa8fb81b4a68b29f341096e65c065d7af29d14f671f281c | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

02b7ff64c6...18.exe

windows7-x64

02b7ff64c6...18.exe

windows10-2004-x64

Sharing

General

Target

02b7ff64c6ab85ea4fd39a8e082c282a_JaffaCakes118
Size

14.2MB
Sample

240427-h9l25aed8t
MD5

02b7ff64c6ab85ea4fd39a8e082c282a
SHA1

d6a1a0e0cd651de2ec4b0ad0753513a30c37e358
SHA256

ece34d78b747a27cefa8fb81b4a68b29f341096e65c065d7af29d14f671f281c
SHA512

7ba0878687286ad67cd6ffbc1bac77b7da16e1d804817429f6685d979a0d14dcffd21675134b99771bc7613b585db0ca1033c96faa26aafd3a4f062a16ea453c
SSDEEP

196608:Ta9+6Y7SOEibgRNKube8Kvla9+6Y7SOEibgRNKube8Kv8:TFgRMFgRJ

Score

10^/10

blackmoon xmrig banker evasion miner persistence spyware stealer trojan upx

Static task

static1

miner upx blackmoon xmrig

6 signatures

Behavioral task

behavioral1

Sample

02b7ff64c6ab85ea4fd39a8e082c282a_JaffaCakes118.exe

Resource

win7-20240220-en

blackmoon xmrig banker evasion miner persistence spyware stealer trojan upx

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

02b7ff64c6ab85ea4fd39a8e082c282a_JaffaCakes118.exe

Resource

win10v2004-20240426-en

blackmoon xmrig banker evasion miner persistence spyware stealer trojan upx

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  02b7ff64c6ab85ea4fd39a8e082c282a_JaffaCakes118
- Size
  
  14.2MB
- MD5
  
  02b7ff64c6ab85ea4fd39a8e082c282a
- SHA1
  
  d6a1a0e0cd651de2ec4b0ad0753513a30c37e358
- SHA256
  
  ece34d78b747a27cefa8fb81b4a68b29f341096e65c065d7af29d14f671f281c
- SHA512
  
  7ba0878687286ad67cd6ffbc1bac77b7da16e1d804817429f6685d979a0d14dcffd21675134b99771bc7613b585db0ca1033c96faa26aafd3a4f062a16ea453c
- SSDEEP
  
  196608:Ta9+6Y7SOEibgRNKube8Kvla9+6Y7SOEibgRNKube8Kv8:TFgRMFgRJ
Score

10^/10

blackmoon xmrig banker evasion miner persistence spyware stealer trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- UAC bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

minerupxblackmoonxmrig

behavioral1

blackmoonxmrigbankerevasionminerpersistencespywarestealertrojanupx

behavioral2

blackmoonxmrigbankerevasionminerpersistencespywarestealertrojanupx

© 2018-2025

Terms | Privacy