blackmoon | 6b02092b67eafefd12562946d5fb60fd5732cf6d08f305260368aeea27c6bcea

General

Target

6b02092b67eafefd12562946d5fb60fd5732cf6d08f305260368aeea27c6bcea
Size

4.5MB
Sample

240523-2qapjaca73
MD5

d9b17b709ecfbde0e51e5e6e2e74c513
SHA1

8ba9a01dbbbf35d3a52301742fc0238a53e843d0
SHA256

6b02092b67eafefd12562946d5fb60fd5732cf6d08f305260368aeea27c6bcea
SHA512

03dbf978a53680c8653f5647e9c8c5be2c4097b811768488f23e5e48fe8f223b417614c4b10f89d4faf04a16bb22d63a17b71d535d0c0ebe83cabb09844df223
SSDEEP

49152:xNIlfFEedDqnroHO8wOZHOlvbuambSIN+6a9AknH:xNI1cnsHtvZHUbmb/+TK

Score

10^/10

Malware Config

Targets

- Target
  
  6b02092b67eafefd12562946d5fb60fd5732cf6d08f305260368aeea27c6bcea
- Size
  
  4.5MB
- MD5
  
  d9b17b709ecfbde0e51e5e6e2e74c513
- SHA1
  
  8ba9a01dbbbf35d3a52301742fc0238a53e843d0
- SHA256
  
  6b02092b67eafefd12562946d5fb60fd5732cf6d08f305260368aeea27c6bcea
- SHA512
  
  03dbf978a53680c8653f5647e9c8c5be2c4097b811768488f23e5e48fe8f223b417614c4b10f89d4faf04a16bb22d63a17b71d535d0c0ebe83cabb09844df223
- SSDEEP
  
  49152:xNIlfFEedDqnroHO8wOZHOlvbuambSIN+6a9AknH:xNI1cnsHtvZHUbmb/+TK
Score

10^/10

blackmoon banker discovery trojan upx spyware stealer
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2