General

  • Target

    035827c9d3a6178051258736ec576102_JaffaCakes118

  • Size

    59KB

  • Sample

    240728-ajabmswfqk

  • MD5

    035827c9d3a6178051258736ec576102

  • SHA1

    6fc89eb024cc5bb0c441b26fcaad20950139df3a

  • SHA256

    e82ebe6fbf963c92553feced9515ca4c57fa742c0955b9dc90ebf9fa692ebccb

  • SHA512

    c5d1dc8895ab08cf1067c4b891603c452a0bbdb58a0a9af65c64a144720f1c507303d7c0ab2a181e27fe181416402cd3731d687e861adbf7236773ad071048b1

  • SSDEEP

    1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAc9AcDEfo1:ymb3NkkiQ3mdBjFoF9Vf

Malware Config

Targets

    • Target

      035827c9d3a6178051258736ec576102_JaffaCakes118

    • Size

      59KB

    • MD5

      035827c9d3a6178051258736ec576102

    • SHA1

      6fc89eb024cc5bb0c441b26fcaad20950139df3a

    • SHA256

      e82ebe6fbf963c92553feced9515ca4c57fa742c0955b9dc90ebf9fa692ebccb

    • SHA512

      c5d1dc8895ab08cf1067c4b891603c452a0bbdb58a0a9af65c64a144720f1c507303d7c0ab2a181e27fe181416402cd3731d687e861adbf7236773ad071048b1

    • SSDEEP

      1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAc9AcDEfo1:ymb3NkkiQ3mdBjFoF9Vf

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks