Overview

overview

10

Static

static

10

ff56710d81...68.exe

windows7-x64

10

ff56710d81...68.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe

  • Size

    6.4MB

  • Sample

    240522-ycr5waea62

  • MD5

    05d61e08ddfd28792276bb7fd4f1bb90

  • SHA1

    dfd1bb53cb3ab5206e543c8a3859e1e5a18a9163

  • SHA256

    ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68

  • SHA512

    76f5127d55c23419345dc7f47c47d915ecc4d593a55b4f426de4e10e17dc2729d51634612c5fd1832125c0024286ad53af8e20a31e3a30bbe4b581b71941e207

  • SSDEEP

    98304:lxGwZA9zHntf0LNCXtgxdRsgznLy+OH7yG+HCvzc7szMoIeCxGJYhAt68F:lhZAdHt+NtV7LxmkEzDPCxGJt6W

Score
10/10
blackmoonbankertrojanvmprotect

Malware Config

Targets

    • Target

      ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe

    • Size

      6.4MB

    • MD5

      05d61e08ddfd28792276bb7fd4f1bb90

    • SHA1

      dfd1bb53cb3ab5206e543c8a3859e1e5a18a9163

    • SHA256

      ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68

    • SHA512

      76f5127d55c23419345dc7f47c47d915ecc4d593a55b4f426de4e10e17dc2729d51634612c5fd1832125c0024286ad53af8e20a31e3a30bbe4b581b71941e207

    • SSDEEP

      98304:lxGwZA9zHntf0LNCXtgxdRsgznLy+OH7yG+HCvzc7szMoIeCxGJYhAt68F:lhZAdHt+NtV7LxmkEzDPCxGJt6W

    Score
    10/10
    blackmoonbankertrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks