Overview

overview

10

Static

static

3

ff1699dad8...e5.exe

windows7-x64

10

ff1699dad8...e5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff1699dad8ac51a1aa53d0e699f8f48826a47bb414359df3b1f94286c6664ae5

  • Size

    62KB

  • Sample

    240521-g6xtsabb82

  • MD5

    32461e04020fb8a7382e43e8f2168a69

  • SHA1

    eef1a3b11cd97ef16e18e93d738f67b7ef58d5bc

  • SHA256

    ff1699dad8ac51a1aa53d0e699f8f48826a47bb414359df3b1f94286c6664ae5

  • SHA512

    d5d68b10a7f504a80141c2c3f72e228bc0d79fe18fdbe9848b9b2d314064afa79027a7a86f0f17a7c42f29045c871e232ca417332be88d53dbbc632558e3a4e2

  • SSDEEP

    1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6bL6G:ymb3NkkiQ3mdBjFIugpG

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      ff1699dad8ac51a1aa53d0e699f8f48826a47bb414359df3b1f94286c6664ae5

    • Size

      62KB

    • MD5

      32461e04020fb8a7382e43e8f2168a69

    • SHA1

      eef1a3b11cd97ef16e18e93d738f67b7ef58d5bc

    • SHA256

      ff1699dad8ac51a1aa53d0e699f8f48826a47bb414359df3b1f94286c6664ae5

    • SHA512

      d5d68b10a7f504a80141c2c3f72e228bc0d79fe18fdbe9848b9b2d314064afa79027a7a86f0f17a7c42f29045c871e232ca417332be88d53dbbc632558e3a4e2

    • SSDEEP

      1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6bL6G:ymb3NkkiQ3mdBjFIugpG

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks