Overview

overview

10

Static

static

10

534438f3e7...0N.exe

windows7-x64

10

534438f3e7...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    534438f3e73b2a97311bce035511ae90N.exe

  • Size

    1.7MB

  • Sample

    240722-d1j4yswapd

  • MD5

    534438f3e73b2a97311bce035511ae90

  • SHA1

    91b6066c70cbd17ad67d8700b8ae34ed055eff31

  • SHA256

    ecd03f2df3bce71d044a5b49a26a263570925d6a8ad5b87228c6b8b2bfbd4e2d

  • SHA512

    9fe53bc3e00d48d11d18316efdc80871a8e55a3157681a7e6591a907cc7c23a539118ab0757b33a75ea31f42dab79bfcc32460af05f527bfc8336075ad7b558c

  • SSDEEP

    49152:6+lYMoRzEVMOiMeGP0NaPNcp0sUPYu7UGHMke:RlrylGcaepMAOsk

Score
10/10
blackmoonbankerdiscoverytrojanupx

Malware Config

Targets

    • Target

      534438f3e73b2a97311bce035511ae90N.exe

    • Size

      1.7MB

    • MD5

      534438f3e73b2a97311bce035511ae90

    • SHA1

      91b6066c70cbd17ad67d8700b8ae34ed055eff31

    • SHA256

      ecd03f2df3bce71d044a5b49a26a263570925d6a8ad5b87228c6b8b2bfbd4e2d

    • SHA512

      9fe53bc3e00d48d11d18316efdc80871a8e55a3157681a7e6591a907cc7c23a539118ab0757b33a75ea31f42dab79bfcc32460af05f527bfc8336075ad7b558c

    • SSDEEP

      49152:6+lYMoRzEVMOiMeGP0NaPNcp0sUPYu7UGHMke:RlrylGcaepMAOsk

    Score
    10/10
    blackmoonbankerdiscoverytrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops startup file

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks