blackmoon | a1e704685c1388c5c58e05fee29a6b217060ed3be9e5d6e6fc31022e37c59b72

General

Target

a1e704685c1388c5c58e05fee29a6b217060ed3be9e5d6e6fc31022e37c59b72
Size

4.5MB
Sample

240523-zp3yksgb28
MD5

112d8926f8370de5d41f7316534999ad
SHA1

c369afdaf96801350aede761b3f88bafb7579ef4
SHA256

a1e704685c1388c5c58e05fee29a6b217060ed3be9e5d6e6fc31022e37c59b72
SHA512

0ace433fe3ec146f543603c8e4a26388d37c47520e71d0e0a1f362845c1336fff7a5a730ff1915bf74cda91475281871f45f6e617755162e591c69052fa84b9b
SSDEEP

49152:xNIlnFEedDqnroHO8wOZHOlvbuambSIN+6a9AknH:xNIBcnsHtvZHUbmb/+TK

Score

10^/10

Malware Config

Targets

- Target
  
  a1e704685c1388c5c58e05fee29a6b217060ed3be9e5d6e6fc31022e37c59b72
- Size
  
  4.5MB
- MD5
  
  112d8926f8370de5d41f7316534999ad
- SHA1
  
  c369afdaf96801350aede761b3f88bafb7579ef4
- SHA256
  
  a1e704685c1388c5c58e05fee29a6b217060ed3be9e5d6e6fc31022e37c59b72
- SHA512
  
  0ace433fe3ec146f543603c8e4a26388d37c47520e71d0e0a1f362845c1336fff7a5a730ff1915bf74cda91475281871f45f6e617755162e591c69052fa84b9b
- SSDEEP
  
  49152:xNIlnFEedDqnroHO8wOZHOlvbuambSIN+6a9AknH:xNIBcnsHtvZHUbmb/+TK
Score

10^/10

blackmoon banker trojan upx discovery spyware stealer
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2