blackmoon | 612b01ee08b64b85d11441fcf9eee53129e5bcda7366bafd7d052caed401460a

General

Target

612b01ee08b64b85d11441fcf9eee53129e5bcda7366bafd7d052caed401460a
Size

4.5MB
Sample

240523-rs5mksec51
MD5

fda76b2c6d8b390a53e44d22316d0e2d
SHA1

0cced80feda64c0c57947f2f18395891b0cae2be
SHA256

612b01ee08b64b85d11441fcf9eee53129e5bcda7366bafd7d052caed401460a
SHA512

e3f89bde68df48929e38abbb478769f7ec29d488230e0496f5d48bbfd7dae324e76b2fbbf284551fbbd68fb65c456f0ea8610ce1694c54b9e9c143f223ba0943
SSDEEP

49152:wNIlMFEedDqnroHO8wOZHOlCgCxSb6oK+GWm0Hk+jTp4:wNIycnsHtvZHQsSb8+/NV

Score

10^/10

Malware Config

Targets

- Target
  
  612b01ee08b64b85d11441fcf9eee53129e5bcda7366bafd7d052caed401460a
- Size
  
  4.5MB
- MD5
  
  fda76b2c6d8b390a53e44d22316d0e2d
- SHA1
  
  0cced80feda64c0c57947f2f18395891b0cae2be
- SHA256
  
  612b01ee08b64b85d11441fcf9eee53129e5bcda7366bafd7d052caed401460a
- SHA512
  
  e3f89bde68df48929e38abbb478769f7ec29d488230e0496f5d48bbfd7dae324e76b2fbbf284551fbbd68fb65c456f0ea8610ce1694c54b9e9c143f223ba0943
- SSDEEP
  
  49152:wNIlMFEedDqnroHO8wOZHOlCgCxSb6oK+GWm0Hk+jTp4:wNIycnsHtvZHQsSb8+/NV
Score

10^/10

blackmoon banker trojan upx discovery spyware stealer
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2