Overview

overview

10

Static

static

3

df2be2e1ec...cf.exe

windows7-x64

10

df2be2e1ec...cf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df2be2e1ecbf2fd8a6f6ca3fae6e8ade12518fd9952ec731bb0237004a71f6cf

  • Size

    11.6MB

  • Sample

    240523-xslscscg6x

  • MD5

    008dfb42fb70c4eebd4478059ae0edc6

  • SHA1

    76a4a873aa6d1f09d1cd292d679becbc5ad38348

  • SHA256

    df2be2e1ecbf2fd8a6f6ca3fae6e8ade12518fd9952ec731bb0237004a71f6cf

  • SHA512

    42998749cb762a99b01a27af960feacd1dff8e84594cf196b0c8cb421944037b0fe9aabe58fa0cd10444927d661b4b72bc327d04336407fc643991b5418ab3da

  • SSDEEP

    196608:GZzrENt07+s5HLnr07w+G0ckFlON5udy0V3VBlYMD+cpvJ/4H3nmghWoa/fsysMi:GZVzn49ckLy0V3VBlYMFgXnU7sElKy

Score
10/10
blackmoonbankerevasionspywarestealertrojanupx

Malware Config

Targets

    • Target

      df2be2e1ecbf2fd8a6f6ca3fae6e8ade12518fd9952ec731bb0237004a71f6cf

    • Size

      11.6MB

    • MD5

      008dfb42fb70c4eebd4478059ae0edc6

    • SHA1

      76a4a873aa6d1f09d1cd292d679becbc5ad38348

    • SHA256

      df2be2e1ecbf2fd8a6f6ca3fae6e8ade12518fd9952ec731bb0237004a71f6cf

    • SHA512

      42998749cb762a99b01a27af960feacd1dff8e84594cf196b0c8cb421944037b0fe9aabe58fa0cd10444927d661b4b72bc327d04336407fc643991b5418ab3da

    • SSDEEP

      196608:GZzrENt07+s5HLnr07w+G0ckFlON5udy0V3VBlYMD+cpvJ/4H3nmghWoa/fsysMi:GZVzn49ckLy0V3VBlYMFgXnU7sElKy

    Score
    10/10
    blackmoonbankerevasionspywarestealertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks