Overview

overview

10

Static

static

3

49cb1808fd...d5.exe

windows7-x64

10

49cb1808fd...d5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49cb1808fd24ce87d3537af04d433a694a8145a338790e8bce9a567f8e1ff6d5

  • Size

    70KB

  • Sample

    240519-z4xecaac84

  • MD5

    773e13b8875d82638b269dfe57eee241

  • SHA1

    e8a691cf28e0f8cf0a95cdd517f13c3248271b80

  • SHA256

    49cb1808fd24ce87d3537af04d433a694a8145a338790e8bce9a567f8e1ff6d5

  • SHA512

    3b65a2c80e55e938379846d3644e1c3a93711cd6b4f6dee89070dc495ab73db736a51b2352d62bb408614eabe3ef771e8db89f260f29ccff45d4308db668baa5

  • SSDEEP

    1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWS5:ymb3NkkiQ3mdBjFIynIK5

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      49cb1808fd24ce87d3537af04d433a694a8145a338790e8bce9a567f8e1ff6d5

    • Size

      70KB

    • MD5

      773e13b8875d82638b269dfe57eee241

    • SHA1

      e8a691cf28e0f8cf0a95cdd517f13c3248271b80

    • SHA256

      49cb1808fd24ce87d3537af04d433a694a8145a338790e8bce9a567f8e1ff6d5

    • SHA512

      3b65a2c80e55e938379846d3644e1c3a93711cd6b4f6dee89070dc495ab73db736a51b2352d62bb408614eabe3ef771e8db89f260f29ccff45d4308db668baa5

    • SSDEEP

      1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWS5:ymb3NkkiQ3mdBjFIynIK5

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks