blackmoon | c0c215652dce57b7f6701c1010ab8bc2f3b2747f7fbdb3b5709c59056a925f53

General

Target

c0c215652dce57b7f6701c1010ab8bc2f3b2747f7fbdb3b5709c59056a925f53
Size

4.5MB
Sample

240523-yqe3gaed57
MD5

a0d4473e618f651ed367fc31b84d493f
SHA1

16809ed4ccc5597a28c8dff6b892726aaab8e1f6
SHA256

c0c215652dce57b7f6701c1010ab8bc2f3b2747f7fbdb3b5709c59056a925f53
SHA512

4afeb7ad57528be8d387c08277aae3d27efad0c219a2809d5bce0f045a04590cafe03e73c44686235f82594ebc918733ec0c1293c3d76036488af25b14ef3945
SSDEEP

49152:xNIl3FEedDqnroHO8wOZHOlvbuambSIN+6a9AknH:xNIBcnsHtvZHUbmb/+TK

Score

10^/10

Malware Config

Targets

- Target
  
  c0c215652dce57b7f6701c1010ab8bc2f3b2747f7fbdb3b5709c59056a925f53
- Size
  
  4.5MB
- MD5
  
  a0d4473e618f651ed367fc31b84d493f
- SHA1
  
  16809ed4ccc5597a28c8dff6b892726aaab8e1f6
- SHA256
  
  c0c215652dce57b7f6701c1010ab8bc2f3b2747f7fbdb3b5709c59056a925f53
- SHA512
  
  4afeb7ad57528be8d387c08277aae3d27efad0c219a2809d5bce0f045a04590cafe03e73c44686235f82594ebc918733ec0c1293c3d76036488af25b14ef3945
- SSDEEP
  
  49152:xNIl3FEedDqnroHO8wOZHOlvbuambSIN+6a9AknH:xNIBcnsHtvZHUbmb/+TK
Score

10^/10

blackmoon banker trojan upx discovery spyware stealer
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2