Overview

overview

10

Static

static

10

2024-07-22...ia.exe

windows7-x64

10

2024-07-22...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-07-22_d46474a8e5812c46b127aa7e4987cf6e_mafia

  • Size

    1.7MB

  • Sample

    240722-rrd38sshlm

  • MD5

    d46474a8e5812c46b127aa7e4987cf6e

  • SHA1

    f9b6a4a733ca57d7258822eec1fbacccc28dcc25

  • SHA256

    c26a451b63f101f57e70b34afd52b373573d5118bf0c76c45c3c2c37e08795ae

  • SHA512

    e376703ad705480723503a4d15006a4568dab2aac65d4605d3681440b38b4f5d95073f7b9d826d4a86124291619e7b99f3e212e2b4f11dd96e0f3d9a1da9de48

  • SSDEEP

    49152:6+lYMoRzMVMOiMeGP0NaPNcp0sUPYu7UGHMke:RlrylGcaepMAOsk

Score
10/10
blackmoonbankerdiscoverytrojanupx

Malware Config

Targets

    • Target

      2024-07-22_d46474a8e5812c46b127aa7e4987cf6e_mafia

    • Size

      1.7MB

    • MD5

      d46474a8e5812c46b127aa7e4987cf6e

    • SHA1

      f9b6a4a733ca57d7258822eec1fbacccc28dcc25

    • SHA256

      c26a451b63f101f57e70b34afd52b373573d5118bf0c76c45c3c2c37e08795ae

    • SHA512

      e376703ad705480723503a4d15006a4568dab2aac65d4605d3681440b38b4f5d95073f7b9d826d4a86124291619e7b99f3e212e2b4f11dd96e0f3d9a1da9de48

    • SSDEEP

      49152:6+lYMoRzMVMOiMeGP0NaPNcp0sUPYu7UGHMke:RlrylGcaepMAOsk

    Score
    10/10
    blackmoonbankerdiscoverytrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops startup file

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks