Overview

overview

10

Static

static

10

fdad773989...43.exe

windows7-x64

10

fdad773989...43.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdad7739899cd8df4f85ef3b756a91df307127b1725762ae37109220e1ad5f43

  • Size

    5.4MB

  • Sample

    240526-lczthaec75

  • MD5

    b4dc5887b91d688df506e1fd272a0d1c

  • SHA1

    bf07fb6ca99090ee51d9b0761737b5733d509ee8

  • SHA256

    fdad7739899cd8df4f85ef3b756a91df307127b1725762ae37109220e1ad5f43

  • SHA512

    3c38ecb24f8f7b49c782fbc99f4d6570d0f065697640d6e6ee7d3bf4296d994caf213cbaadbb2394f49261c6784afe83b516fbebc4952b05f61f1b7dfa6b1219

  • SSDEEP

    98304:bJYCxmskqL8/zQG3xxUgpHj5CndaYxGR03x7HnzzBeqTVrYp:bJYCFjU/pD5CndgKxbXRYp

Score
10/10
blackmoonbankerbootkitpersistencespywarestealertrojanvmprotect

Malware Config

Targets

    • Target

      fdad7739899cd8df4f85ef3b756a91df307127b1725762ae37109220e1ad5f43

    • Size

      5.4MB

    • MD5

      b4dc5887b91d688df506e1fd272a0d1c

    • SHA1

      bf07fb6ca99090ee51d9b0761737b5733d509ee8

    • SHA256

      fdad7739899cd8df4f85ef3b756a91df307127b1725762ae37109220e1ad5f43

    • SHA512

      3c38ecb24f8f7b49c782fbc99f4d6570d0f065697640d6e6ee7d3bf4296d994caf213cbaadbb2394f49261c6784afe83b516fbebc4952b05f61f1b7dfa6b1219

    • SSDEEP

      98304:bJYCxmskqL8/zQG3xxUgpHj5CndaYxGR03x7HnzzBeqTVrYp:bJYCFjU/pD5CndgKxbXRYp

    Score
    10/10
    blackmoonbankerbootkitpersistencespywarestealertrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks