Overview

overview

10

Static

static

10

4fcc4a8fae...99.exe

windows7-x64

10

4fcc4a8fae...99.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499

  • Size

    5.5MB

  • Sample

    240524-jw2q4aae9v

  • MD5

    602371a144a5b0bc0313f25d467e81bf

  • SHA1

    8fc32c0d1dbbf9511e96db08d842c89dc3551398

  • SHA256

    4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499

  • SHA512

    9a884cec66e7ab212dd055dd54624cadfa45f3089f4f082a3d692634ccc7f4c3715e88e7138f1b746671439c5658df276f9afca221ad4de2a82562e8f7ec57b5

  • SSDEEP

    98304:xV2BpGSXTTHz4JBAUZLrHvkrQ2rRETNJGdIeC9HlXr2G3J:HSXTDz4JVHHvkrQ2rREhJGdIeOhr2GZ

Score
10/10
blackmoonbankerbootkitpersistencetrojanupx

Malware Config

Targets

    • Target

      4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499

    • Size

      5.5MB

    • MD5

      602371a144a5b0bc0313f25d467e81bf

    • SHA1

      8fc32c0d1dbbf9511e96db08d842c89dc3551398

    • SHA256

      4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499

    • SHA512

      9a884cec66e7ab212dd055dd54624cadfa45f3089f4f082a3d692634ccc7f4c3715e88e7138f1b746671439c5658df276f9afca221ad4de2a82562e8f7ec57b5

    • SSDEEP

      98304:xV2BpGSXTTHz4JBAUZLrHvkrQ2rRETNJGdIeC9HlXr2G3J:HSXTDz4JVHHvkrQ2rREhJGdIeOhr2GZ

    Score
    10/10
    blackmoonbankerbootkitpersistencetrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks