blackmoon | f95317f8758f28ffc1f7706b6bd8a68f094091ee06e001c9bfe87e792aa1dfc0

General

Target

f95317f8758f28ffc1f7706b6bd8a68f094091ee06e001c9bfe87e792aa1dfc0
Size

2.9MB
Sample

240625-vd8x8s1hkc
MD5

bac00647c096be9861a89a110118b5d0
SHA1

52b5f446af1978f331c69e39375900baf749a4ca
SHA256

f95317f8758f28ffc1f7706b6bd8a68f094091ee06e001c9bfe87e792aa1dfc0
SHA512

a0193ab45d535e58905a7b4d82cd7d304175a1a6812d075c9aac260380bbf6854a4b5cc075a643dcba0cbcf8dd81cafee21df2cac7254602639e87a5d54e433b
SSDEEP

49152:jUjWQ1EPNu5Nx3s/togaiK+QPzatFULvYqDPK7LEEut0Lq0i:oKQ1EPNubxOogaiK+IdDPZi

Score

10^/10

Malware Config

Targets

- Target
  
  f95317f8758f28ffc1f7706b6bd8a68f094091ee06e001c9bfe87e792aa1dfc0
- Size
  
  2.9MB
- MD5
  
  bac00647c096be9861a89a110118b5d0
- SHA1
  
  52b5f446af1978f331c69e39375900baf749a4ca
- SHA256
  
  f95317f8758f28ffc1f7706b6bd8a68f094091ee06e001c9bfe87e792aa1dfc0
- SHA512
  
  a0193ab45d535e58905a7b4d82cd7d304175a1a6812d075c9aac260380bbf6854a4b5cc075a643dcba0cbcf8dd81cafee21df2cac7254602639e87a5d54e433b
- SSDEEP
  
  49152:jUjWQ1EPNu5Nx3s/togaiK+QPzatFULvYqDPK7LEEut0Lq0i:oKQ1EPNubxOogaiK+IdDPZi
Score

10^/10

blackmoon aspackv2 banker discovery trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies file permissions
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon, KrBanker

Detect Blackmoon payload

Drops file in Drivers directory

ASPack v2.12-2.42

Executes dropped EXE

Modifies file permissions

UPX packed file

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2