blackmoon | 90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

90a797019b...23.exe

windows7-x64

90a797019b...23.exe

windows10-2004-x64

Sharing

General

Target

90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123
Size

15.2MB
Sample

240529-dgnb9sgf88
MD5

a258eb79d3c79663b17daa4e272e6e46
SHA1

8f3630580583bd6b6da62de90b16f9abc74622cd
SHA256

90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123
SHA512

2f4d7fdee5d620bbb34604625114b2081f8c54304f4ad1a7d275e39d5cd2cdefaff61afa2d517f8cff3a960e5e5acd6e71ca04146a7e01225849c06451853eb1
SSDEEP

196608:PYPDPy737nKKWUGNEoiN/A4s33/hhUdCAW1MslNY3LhAvx3fg5fADU0+sJm0+nzn:gPDPsLpGNvnodC543LhAvx4fADyL2yOo

Score

10^/10

blackmoon aspackv2 banker trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe

Resource

win7-20240221-en

blackmoon aspackv2 banker trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe

Resource

win10v2004-20240426-en

blackmoon aspackv2 banker trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123
- Size
  
  15.2MB
- MD5
  
  a258eb79d3c79663b17daa4e272e6e46
- SHA1
  
  8f3630580583bd6b6da62de90b16f9abc74622cd
- SHA256
  
  90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123
- SHA512
  
  2f4d7fdee5d620bbb34604625114b2081f8c54304f4ad1a7d275e39d5cd2cdefaff61afa2d517f8cff3a960e5e5acd6e71ca04146a7e01225849c06451853eb1
- SSDEEP
  
  196608:PYPDPy737nKKWUGNEoiN/A4s33/hhUdCAW1MslNY3LhAvx3fg5fADU0+sJm0+nzn:gPDPsLpGNvnodC543LhAvx4fADyL2yOo
Score

10^/10

blackmoon aspackv2 banker trojan
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonaspackv2bankertrojan

behavioral2

blackmoonaspackv2bankertrojan

© 2018-2025

Terms | Privacy