blackmoon | 4cb60f7fceb71c684e8767c3574326bef77e9fe7aee64402e786eee0743cda20 | Triage

Submit
Reports

Overview

overview

Static

static

4cb60f7fce...20.exe

windows7-x64

4cb60f7fce...20.exe

windows10-2004-x64

Sharing

General

Target

4cb60f7fceb71c684e8767c3574326bef77e9fe7aee64402e786eee0743cda20
Size

12.9MB
Sample

240629-g7fxnawapn
MD5

4e5d4e9838afc3c90df8704da4792a3b
SHA1

1291df6f658fdd0f429280c491329c1be77267ef
SHA256

4cb60f7fceb71c684e8767c3574326bef77e9fe7aee64402e786eee0743cda20
SHA512

24bb7ae8b6c64597ead5c4986a0fac4962408f199b31a7ba38b070cb3b1b35eef561765cfef976b8e5b164178ab530d3876dee6cffc8d3d6e6ab9cf88e5a3d18
SSDEEP

393216:jitFmvaeTgEg2ZetCKzfH1uFJCaTb/bv8j:j3aec2MBzcvCybU

Score

10^/10

blackmoon banker trojan upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

4cb60f7fceb71c684e8767c3574326bef77e9fe7aee64402e786eee0743cda20.exe

Resource

win7-20240611-en

blackmoon banker trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

4cb60f7fceb71c684e8767c3574326bef77e9fe7aee64402e786eee0743cda20.exe

Resource

win10v2004-20240508-en

blackmoon banker trojan upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  4cb60f7fceb71c684e8767c3574326bef77e9fe7aee64402e786eee0743cda20
- Size
  
  12.9MB
- MD5
  
  4e5d4e9838afc3c90df8704da4792a3b
- SHA1
  
  1291df6f658fdd0f429280c491329c1be77267ef
- SHA256
  
  4cb60f7fceb71c684e8767c3574326bef77e9fe7aee64402e786eee0743cda20
- SHA512
  
  24bb7ae8b6c64597ead5c4986a0fac4962408f199b31a7ba38b070cb3b1b35eef561765cfef976b8e5b164178ab530d3876dee6cffc8d3d6e6ab9cf88e5a3d18
- SSDEEP
  
  393216:jitFmvaeTgEg2ZetCKzfH1uFJCaTb/bv8j:j3aec2MBzcvCybU
Score

10^/10

blackmoon banker trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankertrojanupx

behavioral2

blackmoonbankertrojanupx

© 2018-2025

Terms | Privacy