blackmoon | 44dbe2cf10a3fe2d0af32bad0024045b347ce299e7910cc474e03f78c5a7a020

General

Target

44dbe2cf10a3fe2d0af32bad0024045b347ce299e7910cc474e03f78c5a7a020
Size

4.5MB
Sample

240523-rxh95sed8s
MD5

7ba92c7baf6a9d389a187df05c98d71a
SHA1

98f58c85d3fb7ac8b51c17d9ed3f06b793a16a46
SHA256

44dbe2cf10a3fe2d0af32bad0024045b347ce299e7910cc474e03f78c5a7a020
SHA512

09301578442b1836e60f91b8c47ddaf35bb93c666c0fac4a525f95b3a8b5216cc70b6dfb9b62d3c4980d76fe3591ed3f89eb5422edbe1f74112c517706e3ae3c
SSDEEP

49152:wNIlUFEedDqnroHO8wOZHOlCgCxSb6oK+GWm0Hk+jTp4:wNIqcnsHtvZHQsSb8+/NV

Score

10^/10

Malware Config

Targets

- Target
  
  44dbe2cf10a3fe2d0af32bad0024045b347ce299e7910cc474e03f78c5a7a020
- Size
  
  4.5MB
- MD5
  
  7ba92c7baf6a9d389a187df05c98d71a
- SHA1
  
  98f58c85d3fb7ac8b51c17d9ed3f06b793a16a46
- SHA256
  
  44dbe2cf10a3fe2d0af32bad0024045b347ce299e7910cc474e03f78c5a7a020
- SHA512
  
  09301578442b1836e60f91b8c47ddaf35bb93c666c0fac4a525f95b3a8b5216cc70b6dfb9b62d3c4980d76fe3591ed3f89eb5422edbe1f74112c517706e3ae3c
- SSDEEP
  
  49152:wNIlUFEedDqnroHO8wOZHOlCgCxSb6oK+GWm0Hk+jTp4:wNIqcnsHtvZHQsSb8+/NV
Score

10^/10

blackmoon banker discovery trojan upx spyware stealer
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2