Overview

overview

10

Static

static

10

175d3f31b6...3a.exe

windows7-x64

10

175d3f31b6...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    175d3f31b665b8071cab34ec8e4e096c88f5cc1f23c3ebb8a31536610a83713a

  • Size

    5.5MB

  • Sample

    240525-t4bvrabb54

  • MD5

    845685bb0bd17c6fb8995580ebeda4a2

  • SHA1

    d01daf799b8ab583e38306f761b788ffae258756

  • SHA256

    175d3f31b665b8071cab34ec8e4e096c88f5cc1f23c3ebb8a31536610a83713a

  • SHA512

    8534de13af9f7068412fc7e84f63d3ef872b3cec361a8fca6b6dd5346277b06514233620ad9e2f07654c301264349ac70a888d51701645fc1d0ae36208a2644c

  • SSDEEP

    98304:vJYCxmskqL8/zQG1xVypCsb09N0rj6j4Koy2C3fN:vJYCFjwwbewju2CP

Score
10/10
blackmoonbankerbootkitpersistencespywarestealertrojanvmprotect

Malware Config

Targets

    • Target

      175d3f31b665b8071cab34ec8e4e096c88f5cc1f23c3ebb8a31536610a83713a

    • Size

      5.5MB

    • MD5

      845685bb0bd17c6fb8995580ebeda4a2

    • SHA1

      d01daf799b8ab583e38306f761b788ffae258756

    • SHA256

      175d3f31b665b8071cab34ec8e4e096c88f5cc1f23c3ebb8a31536610a83713a

    • SHA512

      8534de13af9f7068412fc7e84f63d3ef872b3cec361a8fca6b6dd5346277b06514233620ad9e2f07654c301264349ac70a888d51701645fc1d0ae36208a2644c

    • SSDEEP

      98304:vJYCxmskqL8/zQG1xVypCsb09N0rj6j4Koy2C3fN:vJYCFjwwbewju2CP

    Score
    10/10
    blackmoonbankerbootkitpersistencespywarestealertrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks