Overview

overview

10

Static

static

10

bf924b598e...84.exe

windows7-x64

10

bf924b598e...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf924b598e2dfba94954d1a982bff917d28637f819cae124befdfac8f23a8d84

  • Size

    87KB

  • Sample

    240521-d7dkragf8w

  • MD5

    63173cc80d964d6d908e0899bf489086

  • SHA1

    5a8b7d20531ed7925177604720ffd190b61edd98

  • SHA256

    bf924b598e2dfba94954d1a982bff917d28637f819cae124befdfac8f23a8d84

  • SHA512

    3e9f60e85d9f68389225c21b5e70260c6b123f05c35fc7a8500e52634b3d9535bcb71a996e0f59ac09b360e24bb01bf9a538242cb53c21a436be603c64dfb42c

  • SSDEEP

    1536:Lxos1lS77S/87BJM2pThWf9DcqZmR8/bMxnONDjYseXPmo06/i/XdVw/iA:jjfbcRkbMVu7EqQ/j

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      bf924b598e2dfba94954d1a982bff917d28637f819cae124befdfac8f23a8d84

    • Size

      87KB

    • MD5

      63173cc80d964d6d908e0899bf489086

    • SHA1

      5a8b7d20531ed7925177604720ffd190b61edd98

    • SHA256

      bf924b598e2dfba94954d1a982bff917d28637f819cae124befdfac8f23a8d84

    • SHA512

      3e9f60e85d9f68389225c21b5e70260c6b123f05c35fc7a8500e52634b3d9535bcb71a996e0f59ac09b360e24bb01bf9a538242cb53c21a436be603c64dfb42c

    • SSDEEP

      1536:Lxos1lS77S/87BJM2pThWf9DcqZmR8/bMxnONDjYseXPmo06/i/XdVw/iA:jjfbcRkbMVu7EqQ/j

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks