General

  • Target

    afefe6e2dc5345610466661d10d0f4be7a8879c43acb7b28c87e742f25371182

  • Size

    12.6MB

  • Sample

    240626-hsmx4athjk

  • MD5

    0f7b4b9ff6562f27f16f676bf931089c

  • SHA1

    2306166972725e3d30bb9f3dc3a31b64bfbd3f08

  • SHA256

    afefe6e2dc5345610466661d10d0f4be7a8879c43acb7b28c87e742f25371182

  • SHA512

    6f0979e9a30c17b29096e120438b2e7f712907c0d268bf21caeb95c05e2c7d58dce47f731fa62f8c8cf3f12e5e981064a8a61f1f6827d6c7e65aa0ac03bca3d7

  • SSDEEP

    196608:NunHRJFmIrzoBKl/NKCAOSYB34HLwEOYiTo1u3kCNKVeJtd/m3pMphyc:wH9mSoq/N5SYB485Qu0CNqeJtIGh9

Malware Config

Targets

    • Target

      afefe6e2dc5345610466661d10d0f4be7a8879c43acb7b28c87e742f25371182

    • Size

      12.6MB

    • MD5

      0f7b4b9ff6562f27f16f676bf931089c

    • SHA1

      2306166972725e3d30bb9f3dc3a31b64bfbd3f08

    • SHA256

      afefe6e2dc5345610466661d10d0f4be7a8879c43acb7b28c87e742f25371182

    • SHA512

      6f0979e9a30c17b29096e120438b2e7f712907c0d268bf21caeb95c05e2c7d58dce47f731fa62f8c8cf3f12e5e981064a8a61f1f6827d6c7e65aa0ac03bca3d7

    • SSDEEP

      196608:NunHRJFmIrzoBKl/NKCAOSYB34HLwEOYiTo1u3kCNKVeJtd/m3pMphyc:wH9mSoq/N5SYB485Qu0CNqeJtIGh9

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks