blackmoon | 1a75ed2988d78ce08d8118c877026936b2ef03fd3df0af679045174db9dfcabb

General

Target

1a75ed2988d78ce08d8118c877026936b2ef03fd3df0af679045174db9dfcabb
Size

4.5MB
Sample

240523-rwcqzaed4t
MD5

7968df8d3caaf0e87b8c8947b620746b
SHA1

7255909394c4cb8822cccb5d7945e48d7fb30de1
SHA256

1a75ed2988d78ce08d8118c877026936b2ef03fd3df0af679045174db9dfcabb
SHA512

98dace42d5930ca5baaa48f9209c2631353cc0629411881aa801c4ff6bd9450d9c68be93bb6fa3aa6b0b005b354ab0a41d4892e07c1893d6cfb953fe5a34b53f
SSDEEP

49152:wNIl+FEedDqnroHOnyCzfy3p5J3g2TYIAWVwOZHOlCgCxSb6oK+GWm0Hk+jTp4:wNIMcnsHQy55Jz2GvZHQsSb8+/NV

Score

10^/10

Malware Config

Targets

- Target
  
  1a75ed2988d78ce08d8118c877026936b2ef03fd3df0af679045174db9dfcabb
- Size
  
  4.5MB
- MD5
  
  7968df8d3caaf0e87b8c8947b620746b
- SHA1
  
  7255909394c4cb8822cccb5d7945e48d7fb30de1
- SHA256
  
  1a75ed2988d78ce08d8118c877026936b2ef03fd3df0af679045174db9dfcabb
- SHA512
  
  98dace42d5930ca5baaa48f9209c2631353cc0629411881aa801c4ff6bd9450d9c68be93bb6fa3aa6b0b005b354ab0a41d4892e07c1893d6cfb953fe5a34b53f
- SSDEEP
  
  49152:wNIl+FEedDqnroHOnyCzfy3p5J3g2TYIAWVwOZHOlCgCxSb6oK+GWm0Hk+jTp4:wNIMcnsHQy55Jz2GvZHQsSb8+/NV
Score

10^/10

blackmoon banker trojan upx discovery spyware stealer
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2