Overview

overview

10

Static

static

3

992e0452dd...9f.exe

windows7-x64

1

992e0452dd...9f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17315577823_NeikiAnalytics

  • Size

    217KB

  • Sample

    240521-hz2ptscd77

  • MD5

    e2cd906c1600cf6619e2016e61eccf86

  • SHA1

    005baf6a61e16f572a8ded3964abe440dce1bdde

  • SHA256

    9389538ae79924ce1b12a810ceffd6acecfbdd41cdc13dce63bd8e5d0141cbf8

  • SHA512

    796d9a5abbe239a91f3c0ea3985c59ef3f1f73ecd8da7388e490a34f064277e5275c53e07cc5b1ef67c1e7e7529214c73cd2fee7657cacdb925c48653fc64028

  • SSDEEP

    6144:OI0AI3n3fZ6ylUrg1DFXWyFGlQYLJKOZdBkp:5I3BllxFX3wllAmdS

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      992e0452dd58f031ca85ffd4d9f68a26fb91fb44778044d6a74bd09bfb4d629f

    • Size

      280KB

    • MD5

      592ec0af016e173c46dfd1636bb99ad7

    • SHA1

      555d8de445852c67ae69dee7c1ddda750bb27316

    • SHA256

      992e0452dd58f031ca85ffd4d9f68a26fb91fb44778044d6a74bd09bfb4d629f

    • SHA512

      938b5d2f0c7f8ea3cb26372c719a169fca0e30e5b43ce0f09a66a1cc354ce672fc9795470214e82df0f4b23fd0d07b0eca38767b687dd0fbbd264be7188ba45a

    • SSDEEP

      6144:xnC1Xm2LQJEumPvf9Yik7vDyObWO9feEzqnedNBIal9J+:xC1Xm+QJEIy8WEzqM

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks