Overview

overview

10

Static

static

10

0c0233485f...81.exe

windows7-x64

10

0c0233485f...81.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe

  • Size

    676KB

  • Sample

    240726-qv4mma1bqj

  • MD5

    bd8f6a68e9bab31cab60ac88fd307310

  • SHA1

    4c6ca10b196448fd85d7979b15dda32ba23e2417

  • SHA256

    0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81

  • SHA512

    199ac6702c5f6bb8460ff5ba3484aa1cf3455393aa9ab9ccc863571ed3a6e7b6ef335f8a7bf925f020e501f664c4561fdaa4f49a5962d712d496ad114e9af8a3

  • SSDEEP

    12288:bg8fK/r8bYZYCtOhzodMDPStM8ePO2S4McLs:c8Gr8bYeCtOhzo6D2MG2Js

Score
10/10
blackmoonaspackv2bankerdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe

    • Size

      676KB

    • MD5

      bd8f6a68e9bab31cab60ac88fd307310

    • SHA1

      4c6ca10b196448fd85d7979b15dda32ba23e2417

    • SHA256

      0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81

    • SHA512

      199ac6702c5f6bb8460ff5ba3484aa1cf3455393aa9ab9ccc863571ed3a6e7b6ef335f8a7bf925f020e501f664c4561fdaa4f49a5962d712d496ad114e9af8a3

    • SSDEEP

      12288:bg8fK/r8bYZYCtOhzodMDPStM8ePO2S4McLs:c8Gr8bYeCtOhzo6D2MG2Js

    Score
    10/10
    blackmoonaspackv2bankerdiscoverypersistencetrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Sets service image path in registry

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks