Overview

overview

10

Static

static

3

4.exe

windows7-x64

10

4.exe

windows10-2004-x64

10

EduWebContainer.dll

windows7-x64

3

EduWebContainer.dll

windows10-2004-x64

3

msvcp140.dll

windows7-x64

3

msvcp140.dll

windows10-2004-x64

3

vcruntime140.dll

windows7-x64

3

vcruntime140.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae805b66e85b6d80bff92c0efe364116ec841d287e32520b8548883fe6fdcb86

  • Size

    678KB

  • Sample

    240801-xzk5eayeqg

  • MD5

    0e4c839055d1e78c70cb037302cc52ad

  • SHA1

    6b52a81129d3facacb2fea5b0281cd7c1be14e7b

  • SHA256

    ae805b66e85b6d80bff92c0efe364116ec841d287e32520b8548883fe6fdcb86

  • SHA512

    72eaa4090eab0679b33cd93ca5d74fbac9dc6cf3d5084beab3980fc6e31a1d9700ae17013ce369736e0d3e062573d0138a74e485007fbf3c74622f27bb2a6d15

  • SSDEEP

    12288:jb9gryd0wf7pGuIez5WOrR6RZzQXVqMx7pe7sIc5UeLtl2ljh8PDQ9e:PSq0odG1OrRYky0+mtlaUDae

Score
10/10
blackmoonfatalratbankerdiscoveryinfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      4.exe

    • Size

      111KB

    • MD5

      a9b40e0b76aa5a292cb6052c6c2fd81d

    • SHA1

      e15bba9e662ef45350720218617d563620c76823

    • SHA256

      f5017d72f3b829a55971f877ebaa257f5e9791ae253ae23111cc45628477c36c

    • SHA512

      ad49410a233614128a103ae55155665f563b67daa7411c42bf314a6a6d1c2cb61e4428d9049d0d3209d44a1b5eef1cab00541b6bb41dcf575ff9e7e406a2f23f

    • SSDEEP

      384:HQQA4mqWJ0P+ik1ND3Q69fl6+CQKnrw41MXDGl7xPxh8E9VF0NyrM1t:Q4mqWyPO193X9CQYrw2MXDGVxPxWENgt

    Score
    10/10
    blackmoonfatalratbankerdiscoveryinfostealerpersistencerattrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

    • Target

      EduWebContainer.dll

    • Size

      32KB

    • MD5

      111b15d6ecab19cbebe05baede58d52f

    • SHA1

      8fcb0f976e3ff9c4e0848ea27f8c66f855003c07

    • SHA256

      37e728f9ef57f035b29c1099a266033c8576dfc6a3abfdafc643c4bf7ddd4e6e

    • SHA512

      e3a75de3930e9879ad36325ff40f4d83acc078b94ae349ca99bdea0c73e70921fa77e5604026709642b2207b128f9bac6b5a18ce12c46d04205f1cb68ac828e2

    • SSDEEP

      768:26H5Etjt4S6NklxWrhLT1zRf4x5kiRqbaxQYM:F544Xk4hLT34x5fceSYM

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      msvcp140.dll

    • Size

      429KB

    • MD5

      cfbdf284c12056347e6773cb3949fbba

    • SHA1

      ad3fa5fbbc4296d4a901ea94460762faf3d6a2b8

    • SHA256

      bbecdfda2551b01aa16005c88305982c360a9fb9ba3d9be2fb15f2e9c6eb809f

    • SHA512

      2f24eac94d51f8f28c8e6b6234ca2e481e0f8f1a73df62766ff4f5640480377fb2c4a469babedb87d303503994b469e570aaf725e16da6f9b2d6a77f15b4623f

    • SSDEEP

      12288:lTLNQjAM80l7Vpm8j2NoSpman+hUgiW6QR7t5s03Ooc8dHkC2esumPy:lTLNQcMmYpE903Ooc8dHkC2enm6

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      vcruntime140.dll

    • Size

      77KB

    • MD5

      f107a3c7371c4543bd3908ba729dd2db

    • SHA1

      af8e7e8f446de74db2f31d532e46eab8bbf41e0a

    • SHA256

      00df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0

    • SHA512

      fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530

    • SSDEEP

      1536:ImGzxv5o1xSEIURDbnZ/dvC5cpnHXCh5cecbvo9J/KjJC:Ip5o1YEIU9bnZ/A5y3Jecbvo94FC

    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks