Overview

overview

10

Static

static

10

5c044bdd33...46.exe

windows7-x64

10

5c044bdd33...46.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5c044bdd332a4a8c0e4f61f9ac22ffa382fef25f93392bafcaeb0d575132dd46

  • Size

    9.1MB

  • Sample

    240525-wkrg7sdb42

  • MD5

    ad01785abc8add5dbd2139adc15d4672

  • SHA1

    8a936160c965e86cfeef6c987cd1acdceaad656c

  • SHA256

    5c044bdd332a4a8c0e4f61f9ac22ffa382fef25f93392bafcaeb0d575132dd46

  • SHA512

    b257cdf79904222a90b5ceb33fe538dace8a4611a54036f2bf9f8554b795938ee09be6ebc730bc122452b6b31eda37c24686d64b694874d7b63993748cc244e3

  • SSDEEP

    196608:UbsJivFcx1dugfUR2l8Bf5bsLV2dqYTGjb76937FOc+zYJpwLtcMP6vxQ3L:UbXvFcxDugx8BMABc7sIc+zI6uxQ3

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      5c044bdd332a4a8c0e4f61f9ac22ffa382fef25f93392bafcaeb0d575132dd46

    • Size

      9.1MB

    • MD5

      ad01785abc8add5dbd2139adc15d4672

    • SHA1

      8a936160c965e86cfeef6c987cd1acdceaad656c

    • SHA256

      5c044bdd332a4a8c0e4f61f9ac22ffa382fef25f93392bafcaeb0d575132dd46

    • SHA512

      b257cdf79904222a90b5ceb33fe538dace8a4611a54036f2bf9f8554b795938ee09be6ebc730bc122452b6b31eda37c24686d64b694874d7b63993748cc244e3

    • SSDEEP

      196608:UbsJivFcx1dugfUR2l8Bf5bsLV2dqYTGjb76937FOc+zYJpwLtcMP6vxQ3L:UbXvFcxDugx8BMABc7sIc+zI6uxQ3

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks