Overview

overview

10

Static

static

3

9249f0602d...7e.exe

windows7-x64

10

9249f0602d...7e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e

  • Size

    13.0MB

  • Sample

    240521-rqbxgsgh86

  • MD5

    9f4dcb41af5096272ebcd84649a84d8f

  • SHA1

    dc84d62d3c91b99eea8e8ee438f2daa12f68de15

  • SHA256

    9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e

  • SHA512

    4c0f2d712b48d3c44a34c6f11b2402f66767483b9f33125d9ee27ecfbbae6ce77c740170f7a6eaa9423d80f1187fcee0475bd682816256ba644fab014e5f3579

  • SSDEEP

    196608:GNH5Zq984XyV3G0aXGkFHQajfz8+Ll/nW0ma8zrtvqTn0bBfuew1fuSzb1lj:GNZ+84F0eFwaH8O/WRa8fU70llpG1l

Score
10/10
blackmoonbankerevasiontrojanupx

Malware Config

Targets

    • Target

      9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e

    • Size

      13.0MB

    • MD5

      9f4dcb41af5096272ebcd84649a84d8f

    • SHA1

      dc84d62d3c91b99eea8e8ee438f2daa12f68de15

    • SHA256

      9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e

    • SHA512

      4c0f2d712b48d3c44a34c6f11b2402f66767483b9f33125d9ee27ecfbbae6ce77c740170f7a6eaa9423d80f1187fcee0475bd682816256ba644fab014e5f3579

    • SSDEEP

      196608:GNH5Zq984XyV3G0aXGkFHQajfz8+Ll/nW0ma8zrtvqTn0bBfuew1fuSzb1lj:GNZ+84F0eFwaH8O/WRa8fU70llpG1l

    Score
    10/10
    blackmoonbankerevasiontrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks