Overview

overview

10

Static

static

3

0ae6dc97f5...c4.exe

windows7-x64

10

0ae6dc97f5...c4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ae6dc97f5371e5d308967a5eef91c3e6e3660010eb18d0a2d938054baa1ecc4

  • Size

    82KB

  • Sample

    240611-w63scswhma

  • MD5

    a64a3f42113598ee3ccd708cc60d16ab

  • SHA1

    fd69e0ed4f837b29abb2faf034151260f471dd8b

  • SHA256

    0ae6dc97f5371e5d308967a5eef91c3e6e3660010eb18d0a2d938054baa1ecc4

  • SHA512

    81496af4351577e5456c55ce00c19463470199d5dfc723793eae4f5a26b3b6965b06cdd0abbfd3f1ec059db867e39c6ef0b1abf23442316fe46c223ffea786de

  • SSDEEP

    1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vm:ymb3NkkiQ3mdBjFo6Pfgy3dbc/m

Score
10/10
blackmoonbankertrojanupx

Malware Config

Targets

    • Target

      0ae6dc97f5371e5d308967a5eef91c3e6e3660010eb18d0a2d938054baa1ecc4

    • Size

      82KB

    • MD5

      a64a3f42113598ee3ccd708cc60d16ab

    • SHA1

      fd69e0ed4f837b29abb2faf034151260f471dd8b

    • SHA256

      0ae6dc97f5371e5d308967a5eef91c3e6e3660010eb18d0a2d938054baa1ecc4

    • SHA512

      81496af4351577e5456c55ce00c19463470199d5dfc723793eae4f5a26b3b6965b06cdd0abbfd3f1ec059db867e39c6ef0b1abf23442316fe46c223ffea786de

    • SSDEEP

      1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vm:ymb3NkkiQ3mdBjFo6Pfgy3dbc/m

    Score
    10/10
    blackmoonbankertrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks