Overview

overview

10

Static

static

10

be39ea6aa5...cs.exe

windows7-x64

10

be39ea6aa5...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be39ea6aa5c3e1cb82262cc29207bec0_NeikiAnalytics.exe

  • Size

    436KB

  • Sample

    240519-prt4cahd9x

  • MD5

    be39ea6aa5c3e1cb82262cc29207bec0

  • SHA1

    ec1e745bf0e8f1fc8fda84590070bf535336be94

  • SHA256

    a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6

  • SHA512

    86df5546c71e0ba5bb2ff67b5e22ea426fb880bf6821608203a95805551c24e66a116bb92ffee9590fa25179247b42ed0cdd3229bbbc7cf9ff93850e89d9f5d2

  • SSDEEP

    3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/0/yjUuMx8kQ:q0m2FqgDAuSbAXKfz0c0sUIJHk40/yWM

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      be39ea6aa5c3e1cb82262cc29207bec0_NeikiAnalytics.exe

    • Size

      436KB

    • MD5

      be39ea6aa5c3e1cb82262cc29207bec0

    • SHA1

      ec1e745bf0e8f1fc8fda84590070bf535336be94

    • SHA256

      a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6

    • SHA512

      86df5546c71e0ba5bb2ff67b5e22ea426fb880bf6821608203a95805551c24e66a116bb92ffee9590fa25179247b42ed0cdd3229bbbc7cf9ff93850e89d9f5d2

    • SSDEEP

      3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/0/yjUuMx8kQ:q0m2FqgDAuSbAXKfz0c0sUIJHk40/yWM

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks