Overview

overview

10

Static

static

10

a92b3eac0a...cs.exe

windows7-x64

10

a92b3eac0a...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a92b3eac0add9d96cfe368f83f99d03f41638bbbbf433f3f7dc76c7c411707a7_NeikiAnalytics.exe

  • Size

    2.8MB

  • Sample

    240628-ys2dgstdnq

  • MD5

    34a2e6ee244078eaccc848855b74cae0

  • SHA1

    efebf2e9631a2de4f0214c109e5346a0e77d4845

  • SHA256

    a92b3eac0add9d96cfe368f83f99d03f41638bbbbf433f3f7dc76c7c411707a7

  • SHA512

    31229a6657289b0790c29de8ddf7a1225321f52467cb01a34e4820cd3577f6d692a74bfcbeca8ef41ed2c4e7e0ab3111d43aac99337e0bd3c2ff6222de206568

  • SSDEEP

    49152:tOMNT+hOy1U8EkTYN/KXeqpomFsE01zdBST1WT:oMNChj1U8MN/KXeOFs7OWT

Score
10/10
blackmoonbankerpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      a92b3eac0add9d96cfe368f83f99d03f41638bbbbf433f3f7dc76c7c411707a7_NeikiAnalytics.exe

    • Size

      2.8MB

    • MD5

      34a2e6ee244078eaccc848855b74cae0

    • SHA1

      efebf2e9631a2de4f0214c109e5346a0e77d4845

    • SHA256

      a92b3eac0add9d96cfe368f83f99d03f41638bbbbf433f3f7dc76c7c411707a7

    • SHA512

      31229a6657289b0790c29de8ddf7a1225321f52467cb01a34e4820cd3577f6d692a74bfcbeca8ef41ed2c4e7e0ab3111d43aac99337e0bd3c2ff6222de206568

    • SSDEEP

      49152:tOMNT+hOy1U8EkTYN/KXeqpomFsE01zdBST1WT:oMNChj1U8MN/KXeOFs7OWT

    Score
    10/10
    blackmoonbankerpersistenceprivilege_escalationtrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks