Overview

overview

10

Static

static

3

cde05ef71f...7d.exe

windows7-x64

10

cde05ef71f...7d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d

  • Size

    200KB

  • Sample

    240519-c39xqaec94

  • MD5

    e4777e975db8e4eb21c579c3fed15ed9

  • SHA1

    e912968867961c142b752b2b95c8cb198c5e4532

  • SHA256

    cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d

  • SHA512

    1849c030ea9859f2c4495c0b32eac8bdb75ba7e24969670f9ddfdb88462de9f76334f9fe57a1ce8e7146d727c77056d5c7b94f1c8b22f06cc1d28685c7f255c3

  • SSDEEP

    3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUVv1Tu:n3C9BRIG0asYFm71m8+GdkB9Cv1i

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d

    • Size

      200KB

    • MD5

      e4777e975db8e4eb21c579c3fed15ed9

    • SHA1

      e912968867961c142b752b2b95c8cb198c5e4532

    • SHA256

      cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d

    • SHA512

      1849c030ea9859f2c4495c0b32eac8bdb75ba7e24969670f9ddfdb88462de9f76334f9fe57a1ce8e7146d727c77056d5c7b94f1c8b22f06cc1d28685c7f255c3

    • SSDEEP

      3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUVv1Tu:n3C9BRIG0asYFm71m8+GdkB9Cv1i

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks