Overview

overview

10

Static

static

7

8ed28a33b7...81.exe

windows7-x64

10

8ed28a33b7...81.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ed28a33b7109234a832d4131723949736a78892d33228f2c078840018a21081

  • Size

    1.4MB

  • Sample

    240523-vvwn8sac88

  • MD5

    0cf6ef89fd8080d6a8f81e863cd5b93f

  • SHA1

    4473a8fd474a316a5c3fc0bbff565f1204401b20

  • SHA256

    8ed28a33b7109234a832d4131723949736a78892d33228f2c078840018a21081

  • SHA512

    433ec826bf7abef99c9a1ea7a4da5e16bcd07da36da0a5c02673f70fe2c5d391964f25429aa7fbd22e5f0fdf8245867e06044b07a37444ecf068a8d599531a6f

  • SSDEEP

    24576:m0bajn5sNJOZDV1USRveLWoq/Ed6BVq+RGSbp8A7ifqVnRTRpSHgRiC:mxsNUFbRRveLWSYB4+I9A+fInzoHgkC

Score
10/10
blackmoonbankertrojanvmprotect

Malware Config

Targets

    • Target

      8ed28a33b7109234a832d4131723949736a78892d33228f2c078840018a21081

    • Size

      1.4MB

    • MD5

      0cf6ef89fd8080d6a8f81e863cd5b93f

    • SHA1

      4473a8fd474a316a5c3fc0bbff565f1204401b20

    • SHA256

      8ed28a33b7109234a832d4131723949736a78892d33228f2c078840018a21081

    • SHA512

      433ec826bf7abef99c9a1ea7a4da5e16bcd07da36da0a5c02673f70fe2c5d391964f25429aa7fbd22e5f0fdf8245867e06044b07a37444ecf068a8d599531a6f

    • SSDEEP

      24576:m0bajn5sNJOZDV1USRveLWoq/Ed6BVq+RGSbp8A7ifqVnRTRpSHgRiC:mxsNUFbRRveLWSYB4+I9A+fInzoHgkC

    Score
    10/10
    blackmoonbankertrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks