blackmoon | 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14

General

Target

5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14
Size

3.5MB
Sample

240523-2ra2pacb5v
MD5

484173528bb1a9acca132455e421923f
SHA1

81d09d930580ddaa790d0188f38f377a28feb7a4
SHA256

5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14
SHA512

43af002a53f57792ffa341ea6069b97c648e93ecec693171167dfe21d90af9a47cb42818523325ee6d005f6fef31aa73bcbc8aec90874374248eeb29f62a18a3
SSDEEP

24576:TNIPd/zHfWWrwPC6zwXFEc4GdDrGnrdEROGHOhABoaQW8O0C/hRJHOhYa6EZ76d1:TNIlvFEedDqnroHO8wOZHOzH51IGgik

Score

10^/10

Malware Config

Targets

- Target
  
  5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14
- Size
  
  3.5MB
- MD5
  
  484173528bb1a9acca132455e421923f
- SHA1
  
  81d09d930580ddaa790d0188f38f377a28feb7a4
- SHA256
  
  5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14
- SHA512
  
  43af002a53f57792ffa341ea6069b97c648e93ecec693171167dfe21d90af9a47cb42818523325ee6d005f6fef31aa73bcbc8aec90874374248eeb29f62a18a3
- SSDEEP
  
  24576:TNIPd/zHfWWrwPC6zwXFEc4GdDrGnrdEROGHOhABoaQW8O0C/hRJHOhYa6EZ76d1:TNIlvFEedDqnroHO8wOZHOzH51IGgik
Score

10^/10

blackmoon banker discovery spyware stealer trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2