Overview

overview

10

Static

static

1

be5183757a...cs.exe

windows7-x64

10

be5183757a...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be5183757aade6aaead3c0534a82d590_NeikiAnalytics.exe

  • Size

    274KB

  • Sample

    240524-y96pjaaa6w

  • MD5

    be5183757aade6aaead3c0534a82d590

  • SHA1

    356d496741833d1c7601ef7af4a214a609919513

  • SHA256

    bafd54f03848de4dfef3c7e8cbdf5c5d743db75b8a1e6012d0380589e8b1abe5

  • SHA512

    a86bb4c46f24c4b523f92a2663ee43e956b8b4c44b9e966585d6ebe1720d49e46fd9ff64b854b4b521dc558d7cac05ce27a5a4be5cc4931a97018fca6fea5776

  • SSDEEP

    6144:Rds8mzWmX7O5KsZT1kT7lEjvjmAtpnjpo:Rds8XpKsZ5m7lEjvSAXn

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      be5183757aade6aaead3c0534a82d590_NeikiAnalytics.exe

    • Size

      274KB

    • MD5

      be5183757aade6aaead3c0534a82d590

    • SHA1

      356d496741833d1c7601ef7af4a214a609919513

    • SHA256

      bafd54f03848de4dfef3c7e8cbdf5c5d743db75b8a1e6012d0380589e8b1abe5

    • SHA512

      a86bb4c46f24c4b523f92a2663ee43e956b8b4c44b9e966585d6ebe1720d49e46fd9ff64b854b4b521dc558d7cac05ce27a5a4be5cc4931a97018fca6fea5776

    • SSDEEP

      6144:Rds8mzWmX7O5KsZT1kT7lEjvjmAtpnjpo:Rds8XpKsZ5m7lEjvSAXn

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks