Overview

overview

10

Static

static

3

c3f1952ab8...9e.exe

windows7-x64

7

c3f1952ab8...9e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e

  • Size

    11.4MB

  • Sample

    240523-2vsqxacc97

  • MD5

    6b8be8350765348dd1752b0a0f8243f4

  • SHA1

    155aa6ebaf9d86231854faf1162a0e9b0320c9a7

  • SHA256

    c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e

  • SHA512

    f3f437f53b69b172a71f8377fd196c2badf151de1496fd88b7976296141c5e2c0c983e85b70ca05a635d2024b168cba9fab149e74ab3dec525aa3b31db3452c2

  • SSDEEP

    196608:8Fl5poKEGK54nLHXD4oOVqMBfOo6eU7iayz+r83k8EzBnMpAf2FaqKM:8rTEy3cVqMdaiayZkBzBiAeFaDM

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e

    • Size

      11.4MB

    • MD5

      6b8be8350765348dd1752b0a0f8243f4

    • SHA1

      155aa6ebaf9d86231854faf1162a0e9b0320c9a7

    • SHA256

      c3f1952ab8f8ca9cd493ba15d20c105cc85371f70dd0f2b7abf49c0dea17929e

    • SHA512

      f3f437f53b69b172a71f8377fd196c2badf151de1496fd88b7976296141c5e2c0c983e85b70ca05a635d2024b168cba9fab149e74ab3dec525aa3b31db3452c2

    • SSDEEP

      196608:8Fl5poKEGK54nLHXD4oOVqMBfOo6eU7iayz+r83k8EzBnMpAf2FaqKM:8rTEy3cVqMdaiayZkBzBiAeFaDM

    Score
    10/10
    upxblackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks