blackmoon | 8bad2fcf79c827e6c19f78bf8d5dd77100321be70345dda93ef0eb9dfcc28d8a

General

Target

03fc3ea2053c9e9b0505fb71fa23c9eb_JaffaCakes118
Size

20.4MB
Sample

240428-avxlbaca49
MD5

03fc3ea2053c9e9b0505fb71fa23c9eb
SHA1

f64c8a4d889fb0a6b8f241f2e2a999248ad4d46b
SHA256

8bad2fcf79c827e6c19f78bf8d5dd77100321be70345dda93ef0eb9dfcc28d8a
SHA512

1544cc0aacf231933941cfc33939f1ec89444ce347e9c108d3bda05196f9cb70156ad53c2674c6dbfb2182e11f7bfc04db92344c6d3eda80457fe5deb8c844a6
SSDEEP

196608:Ta9+6Y7SOEibgR9bWyzPpCL/D53Qvkr23ya9+6Y7SOEibgR9bWyzPpCL/D53Qvko:TFgR4yzPpe/D53oIFgR4yzPpe/D53o

Score

10^/10

Malware Config

Targets

- Target
  
  03fc3ea2053c9e9b0505fb71fa23c9eb_JaffaCakes118
- Size
  
  20.4MB
- MD5
  
  03fc3ea2053c9e9b0505fb71fa23c9eb
- SHA1
  
  f64c8a4d889fb0a6b8f241f2e2a999248ad4d46b
- SHA256
  
  8bad2fcf79c827e6c19f78bf8d5dd77100321be70345dda93ef0eb9dfcc28d8a
- SHA512
  
  1544cc0aacf231933941cfc33939f1ec89444ce347e9c108d3bda05196f9cb70156ad53c2674c6dbfb2182e11f7bfc04db92344c6d3eda80457fe5deb8c844a6
- SSDEEP
  
  196608:Ta9+6Y7SOEibgR9bWyzPpCL/D53Qvkr23ya9+6Y7SOEibgR9bWyzPpCL/D53Qvko:TFgR4yzPpe/D53oIFgR4yzPpe/D53o
Score

10^/10

blackmoon xmrig banker evasion miner persistence spyware stealer trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- UAC bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2