Overview

overview

10

Static

static

3

8ed3441cdd...e4.exe

windows7-x64

10

8ed3441cdd...e4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ed3441cddbd03bd8c34265eea9cfdfe718a37242bb0bcc98d83ef9b386be3e4

  • Size

    10.7MB

  • Sample

    240526-htrmnsag5w

  • MD5

    77911a8c087c9fdee0fa56963bfc4919

  • SHA1

    9490bc67abf093bd0331a409f3211274c47b462b

  • SHA256

    8ed3441cddbd03bd8c34265eea9cfdfe718a37242bb0bcc98d83ef9b386be3e4

  • SHA512

    8329495b3ecd9447b21cf75cb7f649d92a7c507d54d08b316a3589b9d24f3ef13d542acbac7d508ebc56a53876db03185da93c9c5beb29d4962e53ab07220ce3

  • SSDEEP

    196608:pBTCMQy/y68FdL5RhTEMjv/n0MqScLCQbDTGz1dSdX0JIPzM9oCBEWpz:iMcPL5R5EMjvvXqS+TGBdSdEJIy

Score
10/10
blackmoonbankerbootkitpersistencetrojanupx

Malware Config

Targets

    • Target

      8ed3441cddbd03bd8c34265eea9cfdfe718a37242bb0bcc98d83ef9b386be3e4

    • Size

      10.7MB

    • MD5

      77911a8c087c9fdee0fa56963bfc4919

    • SHA1

      9490bc67abf093bd0331a409f3211274c47b462b

    • SHA256

      8ed3441cddbd03bd8c34265eea9cfdfe718a37242bb0bcc98d83ef9b386be3e4

    • SHA512

      8329495b3ecd9447b21cf75cb7f649d92a7c507d54d08b316a3589b9d24f3ef13d542acbac7d508ebc56a53876db03185da93c9c5beb29d4962e53ab07220ce3

    • SSDEEP

      196608:pBTCMQy/y68FdL5RhTEMjv/n0MqScLCQbDTGz1dSdX0JIPzM9oCBEWpz:iMcPL5R5EMjvvXqS+TGBdSdEJIy

    Score
    10/10
    blackmoonbankerbootkitpersistencetrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks