Overview

overview

10

Static

static

7

bbbe788f2a...c4.exe

windows7-x64

10

bbbe788f2a...c4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bbbe788f2a3eb45bdc8d706d4fe08ad72c80abcb7f0d3070a8ba436a287206c4

  • Size

    6.6MB

  • Sample

    240522-txk5vahb4t

  • MD5

    7b6fceec51020fe3c49a3fe0d7e02322

  • SHA1

    53f4aa9062854ce5acbb7169d9d67fbca2dd4bd7

  • SHA256

    bbbe788f2a3eb45bdc8d706d4fe08ad72c80abcb7f0d3070a8ba436a287206c4

  • SHA512

    e1bf12d6491fd2d7d520646772ce6047af3a9bd67ac2587e7558981cab2231e5e3964bfa7ee4a5d5d04856093c4309cd0a04d103206637e2793a974e60d828b0

  • SSDEEP

    196608:hKwWfk/8BKiynvdJqiDa3hYR5NPLMu3H96y:AZs/8BKiyaxYRHMof

Score
10/10
blackmoonbankertrojanupxvmprotect

Malware Config

Targets

    • Target

      bbbe788f2a3eb45bdc8d706d4fe08ad72c80abcb7f0d3070a8ba436a287206c4

    • Size

      6.6MB

    • MD5

      7b6fceec51020fe3c49a3fe0d7e02322

    • SHA1

      53f4aa9062854ce5acbb7169d9d67fbca2dd4bd7

    • SHA256

      bbbe788f2a3eb45bdc8d706d4fe08ad72c80abcb7f0d3070a8ba436a287206c4

    • SHA512

      e1bf12d6491fd2d7d520646772ce6047af3a9bd67ac2587e7558981cab2231e5e3964bfa7ee4a5d5d04856093c4309cd0a04d103206637e2793a974e60d828b0

    • SSDEEP

      196608:hKwWfk/8BKiynvdJqiDa3hYR5NPLMu3H96y:AZs/8BKiyaxYRHMof

    Score
    10/10
    blackmoonbankertrojanupxvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks