Overview

overview

10

Static

static

3

faf9b2a7a9...a2.exe

windows7-x64

10

faf9b2a7a9...a2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2

  • Size

    287KB

  • Sample

    240522-cq92yshb67

  • MD5

    a10420c0e62d533524339d8a8e5fa8c7

  • SHA1

    b474bfc351e19a0174192e0fa3fe5b59a3ae3349

  • SHA256

    faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2

  • SHA512

    a0eef4471af693b5075ecc079f080e56b1e8cb04797186969d590d3391a5ccc97e925b59b04f45185124d292b1053c83ac351c12e9df64c8d317e312aa4121ae

  • SSDEEP

    6144:mjGwSZAiQfBZAiF5FEca4jx1kEVfp7trTg1nV/3OnQJVrALo2hiZ/2b:mjGwShaLEvm1ZBYF+nKWM2AZ

Score
10/10
blackmoonbankerpersistencetrojanupx

Malware Config

Targets

    • Target

      faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2

    • Size

      287KB

    • MD5

      a10420c0e62d533524339d8a8e5fa8c7

    • SHA1

      b474bfc351e19a0174192e0fa3fe5b59a3ae3349

    • SHA256

      faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2

    • SHA512

      a0eef4471af693b5075ecc079f080e56b1e8cb04797186969d590d3391a5ccc97e925b59b04f45185124d292b1053c83ac351c12e9df64c8d317e312aa4121ae

    • SSDEEP

      6144:mjGwSZAiQfBZAiF5FEca4jx1kEVfp7trTg1nV/3OnQJVrALo2hiZ/2b:mjGwShaLEvm1ZBYF+nKWM2AZ

    Score
    10/10
    blackmoonbankerpersistencetrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks