blackmoon | c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6

General

Target
c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6
Size 2.6MB
Sample240509-nc9d2shc84
SHA256 c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6
MD5 584ee828a62a16a43cdf707ee0404dfd
SHA1 a244cf8bbdaa1cc7176cce70c9d37aca5ab7d61a
SHA512 c63865964603ecf1a7934f40f2502026a17d72a444584d22ed1d840ae3fc13b1d24902d964363403195debb765ce2b5d64f5033e94aed51141a8a63e4f539654
SSDEEP 49152:aYREXSVMDi3NnsHyjtk2MYC5GD7LCC12IX:P2SVMD8Nnsmtk2auCW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6
- Size 2.6MB
- SHA256 c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6
- MD5 584ee828a62a16a43cdf707ee0404dfd
- SHA1 a244cf8bbdaa1cc7176cce70c9d37aca5ab7d61a
- SHA512 c63865964603ecf1a7934f40f2502026a17d72a444584d22ed1d840ae3fc13b1d24902d964363403195debb765ce2b5d64f5033e94aed51141a8a63e4f539654
- SSDEEP 49152:aYREXSVMDi3NnsHyjtk2MYC5GD7LCC12IX:P2SVMD8Nnsmtk2auCW
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

blackmoon gh0strat xred backdoor banker discovery persistence rat trojan upx defense_evasion
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Server Software Component: Terminal Services DLL
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2