Overview

overview

10

Static

static

3

fa98ffa604...8a.exe

windows7-x64

10

fa98ffa604...8a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe

  • Size

    10.0MB

  • Sample

    240524-mn5dssea37

  • MD5

    0f76bcc0a7de6edf80f35d4dc05e28d4

  • SHA1

    b2e1f3e1b640089208c509329e34831404efd55e

  • SHA256

    fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a

  • SHA512

    eeb3485ba73db10b0bb45f125f4cee745456f2f7cd8e6419c5561ac0f79f1f359783063f341afd3a9c8a1d87b9b01dc7d749c93ea126893ba71e871ee0b4fcd9

  • SSDEEP

    196608:QpOfjom+j8qq1USf/7+qqWRD31fqzO7P95lv77q/ANPYRuY+Ge:TV+YqqPT+aD3FqslvCI9Y

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe

    • Size

      10.0MB

    • MD5

      0f76bcc0a7de6edf80f35d4dc05e28d4

    • SHA1

      b2e1f3e1b640089208c509329e34831404efd55e

    • SHA256

      fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a

    • SHA512

      eeb3485ba73db10b0bb45f125f4cee745456f2f7cd8e6419c5561ac0f79f1f359783063f341afd3a9c8a1d87b9b01dc7d749c93ea126893ba71e871ee0b4fcd9

    • SSDEEP

      196608:QpOfjom+j8qq1USf/7+qqWRD31fqzO7P95lv77q/ANPYRuY+Ge:TV+YqqPT+aD3FqslvCI9Y

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks