Overview

overview

10

Static

static

3

8965bdb5bb...d0.exe

windows7-x64

10

8965bdb5bb...d0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8965bdb5bb323009a71c47a501d4dd51f0320296c49ae3b19d1024f944e8b4d0

  • Size

    335KB

  • Sample

    240520-aezezaad7t

  • MD5

    af6ad3acbe2076138820f6478b06db2f

  • SHA1

    b881e52eefc8b1fc287f47730c7eb75652cd08f8

  • SHA256

    8965bdb5bb323009a71c47a501d4dd51f0320296c49ae3b19d1024f944e8b4d0

  • SHA512

    3848ee3633046084c089429803259dff7bcee172f4e9da03961fdc90214a925cf6807ece7ceb56b577c491dde767c26c19dae7f06b9e053cd0a558dc112d547a

  • SSDEEP

    3072:ymb3NkkiQ3mdBjFo7LCgnilBxBqwZK2q6sYTsmZDSFdBE0rXE4efx:n3C9BRo/CEilXBG2qZSlSFdBXExx

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      8965bdb5bb323009a71c47a501d4dd51f0320296c49ae3b19d1024f944e8b4d0

    • Size

      335KB

    • MD5

      af6ad3acbe2076138820f6478b06db2f

    • SHA1

      b881e52eefc8b1fc287f47730c7eb75652cd08f8

    • SHA256

      8965bdb5bb323009a71c47a501d4dd51f0320296c49ae3b19d1024f944e8b4d0

    • SHA512

      3848ee3633046084c089429803259dff7bcee172f4e9da03961fdc90214a925cf6807ece7ceb56b577c491dde767c26c19dae7f06b9e053cd0a558dc112d547a

    • SSDEEP

      3072:ymb3NkkiQ3mdBjFo7LCgnilBxBqwZK2q6sYTsmZDSFdBE0rXE4efx:n3C9BRo/CEilXBG2qZSlSFdBXExx

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks