Overview

overview

10

Static

static

10

4ad42d4344...cs.exe

windows7-x64

10

4ad42d4344...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe

  • Size

    440KB

  • Sample

    240519-2a24vadf7x

  • MD5

    4ad42d43445abc102688f86e89ace170

  • SHA1

    2b8e9d9711b10e911f3bff1e6e40644fe3d3497d

  • SHA256

    934d4399b08eb4a0f7d0a7e3fa1da96d9f480e0159222e2fc774ffedaa735319

  • SHA512

    9a769e69e51edde22f5de02f0f3d5c37e21774578c0ba6400202a9f22d64c39ee1a07b4c3f616fedbcaea1af2c5bd4a88f3d33f837deeb25080781bd1303f23b

  • SSDEEP

    6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAO:xgXQKSLpOCtV0R8xMSaAO

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe

    • Size

      440KB

    • MD5

      4ad42d43445abc102688f86e89ace170

    • SHA1

      2b8e9d9711b10e911f3bff1e6e40644fe3d3497d

    • SHA256

      934d4399b08eb4a0f7d0a7e3fa1da96d9f480e0159222e2fc774ffedaa735319

    • SHA512

      9a769e69e51edde22f5de02f0f3d5c37e21774578c0ba6400202a9f22d64c39ee1a07b4c3f616fedbcaea1af2c5bd4a88f3d33f837deeb25080781bd1303f23b

    • SSDEEP

      6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAO:xgXQKSLpOCtV0R8xMSaAO

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks