Overview

overview

10

Static

static

10

fe5c078f4c...cs.exe

windows7-x64

10

fe5c078f4c...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe

  • Size

    431KB

  • Sample

    240519-vs8wsahc9y

  • MD5

    fe5c078f4c2a9db24d6753b072789fd0

  • SHA1

    a4ac4c28b54a2b1977b0ec0214880b8da27dd0fa

  • SHA256

    fd02c10d5ac1eb5af6f3eb11716b5528c5fac13b099e1cf741f2320503f56374

  • SHA512

    f2bfe0426b9283909eb9d3fe32cbb87eee79dc225cc4156d654947c1bdf0f0912a1a3ee4a76b69df07c3e654d48fa13c1f93e6c8ccd35576c5d40b20903b0d20

  • SSDEEP

    3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUh:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+m

Score
10/10
blackmoonbankertrojan

Malware Config

Targets

    • Target

      fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe

    • Size

      431KB

    • MD5

      fe5c078f4c2a9db24d6753b072789fd0

    • SHA1

      a4ac4c28b54a2b1977b0ec0214880b8da27dd0fa

    • SHA256

      fd02c10d5ac1eb5af6f3eb11716b5528c5fac13b099e1cf741f2320503f56374

    • SHA512

      f2bfe0426b9283909eb9d3fe32cbb87eee79dc225cc4156d654947c1bdf0f0912a1a3ee4a76b69df07c3e654d48fa13c1f93e6c8ccd35576c5d40b20903b0d20

    • SSDEEP

      3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUh:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+m

    Score
    10/10
    blackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks