Overview

overview

10

Static

static

3

20c4f5883f...f8.exe

windows7-x64

10

20c4f5883f...f8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20c4f5883fa31be86c63aa94071a0a25e5d85dc609f2d4ab8825f1a9cc8d49f8

  • Size

    75KB

  • Sample

    240520-yvgrvsfa99

  • MD5

    d65912a676dbba67d50a26a52c599559

  • SHA1

    e99c47a896288b17aea261f62327fdf0146aab0d

  • SHA256

    20c4f5883fa31be86c63aa94071a0a25e5d85dc609f2d4ab8825f1a9cc8d49f8

  • SHA512

    0fa9a930e732316b9fa6bb56bd1ceb7251cdb73f032c3ba6f0ea0405c688024eaf2b280083ebdf1393f4f4e21d1bfbc51466f938ac388cf8f6aa6d40a7dc8ae6

  • SSDEEP

    1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqKrc:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqKY

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      20c4f5883fa31be86c63aa94071a0a25e5d85dc609f2d4ab8825f1a9cc8d49f8

    • Size

      75KB

    • MD5

      d65912a676dbba67d50a26a52c599559

    • SHA1

      e99c47a896288b17aea261f62327fdf0146aab0d

    • SHA256

      20c4f5883fa31be86c63aa94071a0a25e5d85dc609f2d4ab8825f1a9cc8d49f8

    • SHA512

      0fa9a930e732316b9fa6bb56bd1ceb7251cdb73f032c3ba6f0ea0405c688024eaf2b280083ebdf1393f4f4e21d1bfbc51466f938ac388cf8f6aa6d40a7dc8ae6

    • SSDEEP

      1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqKrc:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqKY

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks