Overview

overview

10

Static

static

10

1005c4bcea...74.exe

windows7-x64

10

1005c4bcea...74.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1005c4bceac39031ba8b54a9d974a2f2ac623c9db25ba1ab91b0275172fd8974

  • Size

    6.1MB

  • Sample

    240524-bcgb2sfd8s

  • MD5

    4ffd68fddb924352615831a439d5b2cc

  • SHA1

    0fb5d3da4f1ec00a593d0db6def3ec0359446974

  • SHA256

    1005c4bceac39031ba8b54a9d974a2f2ac623c9db25ba1ab91b0275172fd8974

  • SHA512

    6bcd444a7f960b837185344159221503d69c64110a7b7a89dd14059d9421e8eb8d81e4a44d2d96f947929eb5d521f558227a39ee89d3cc0959c41d0c18ef3fe4

  • SSDEEP

    98304:qxhIfPHqQlYmUfiyeeuSJHNYMSfUoe9h1zHSoLQE/D4ocaDE1/s7yd3Io/YD:qk3HqQlYm85uTbfUoWp3BDE+oZM

Score
10/10
blackmoonbankertrojanvmprotect

Malware Config

Targets

    • Target

      1005c4bceac39031ba8b54a9d974a2f2ac623c9db25ba1ab91b0275172fd8974

    • Size

      6.1MB

    • MD5

      4ffd68fddb924352615831a439d5b2cc

    • SHA1

      0fb5d3da4f1ec00a593d0db6def3ec0359446974

    • SHA256

      1005c4bceac39031ba8b54a9d974a2f2ac623c9db25ba1ab91b0275172fd8974

    • SHA512

      6bcd444a7f960b837185344159221503d69c64110a7b7a89dd14059d9421e8eb8d81e4a44d2d96f947929eb5d521f558227a39ee89d3cc0959c41d0c18ef3fe4

    • SSDEEP

      98304:qxhIfPHqQlYmUfiyeeuSJHNYMSfUoe9h1zHSoLQE/D4ocaDE1/s7yd3Io/YD:qk3HqQlYm85uTbfUoWp3BDE+oZM

    Score
    10/10
    blackmoonbankertrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks