Overview

overview

10

Static

static

10

08c0175f71...3f.exe

windows7-x64

10

08c0175f71...3f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08c0175f71792453e4b5d5e1d57c3c6e5c005d5739fe3bd46179759698e5313f

  • Size

    9.1MB

  • Sample

    240524-ccwbmshd55

  • MD5

    3fcd5ef4ceb92c5b4b25b654f81267a0

  • SHA1

    fedad3c3d0aa6b6115baca21488a0ff903a4894d

  • SHA256

    08c0175f71792453e4b5d5e1d57c3c6e5c005d5739fe3bd46179759698e5313f

  • SHA512

    4e1fa07020ada8e53af9819df9506121ce86d42ca2bfb68bb05a03299b49f078e0987d71a43ed7878adcb232258acd75dc076852a66398b6f8cd991a9c4c7ed0

  • SSDEEP

    196608:/bsJnpbwoCE87/vZj0qcxeKHOsBCxmGjY7xj+z+vI5ng736oz3dwaml/rAc+l15k:/bkpbTCb7Z/yGml7l+z+0nCjIUc+l1nG

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      08c0175f71792453e4b5d5e1d57c3c6e5c005d5739fe3bd46179759698e5313f

    • Size

      9.1MB

    • MD5

      3fcd5ef4ceb92c5b4b25b654f81267a0

    • SHA1

      fedad3c3d0aa6b6115baca21488a0ff903a4894d

    • SHA256

      08c0175f71792453e4b5d5e1d57c3c6e5c005d5739fe3bd46179759698e5313f

    • SHA512

      4e1fa07020ada8e53af9819df9506121ce86d42ca2bfb68bb05a03299b49f078e0987d71a43ed7878adcb232258acd75dc076852a66398b6f8cd991a9c4c7ed0

    • SSDEEP

      196608:/bsJnpbwoCE87/vZj0qcxeKHOsBCxmGjY7xj+z+vI5ng736oz3dwaml/rAc+l15k:/bkpbTCb7Z/yGml7l+z+0nCjIUc+l1nG

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks