blackmoon | 88bc21f82c5a4e6574b3caf8f7b5a6169d0ed336476fd539cae6ee13eadc01ce | Triage

Submit
Reports

Overview

overview

Static

static

88bc21f82c...ce.exe

windows7-x64

88bc21f82c...ce.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

88bc21f82c5a4e6574b3caf8f7b5a6169d0ed336476fd539cae6ee13eadc01ce
Size

1.8MB
Sample

240807-af8d9sycpg
MD5

7fa5282db8a98340220419a8787543a7
SHA1

8f61f823d951b1748393845504b833e881b15693
SHA256

88bc21f82c5a4e6574b3caf8f7b5a6169d0ed336476fd539cae6ee13eadc01ce
SHA512

8c73528f1391966670a4bd9e21a492f3249276b0e2bc81138a9c34edb02c79f254cd76743f7bf5ba07e9b3e9979d5bc9d71fb5738324b9eb6154477fb92a29d7
SSDEEP

24576:tr0TxazTID9UhQtRlA6Jz7kzSRciXSD3FbbBN/IyZJbOOEHqBh3SWgSklWNyK:tZzED7tRX8SWwWpNN/IyjEOBST1WNyK

Score

10^/10

blackmoon banker discovery persistence privilege_escalation trojan upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

88bc21f82c5a4e6574b3caf8f7b5a6169d0ed336476fd539cae6ee13eadc01ce.exe

Resource

win7-20240704-en

blackmoon banker discovery persistence privilege_escalation trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

88bc21f82c5a4e6574b3caf8f7b5a6169d0ed336476fd539cae6ee13eadc01ce.exe

Resource

win10v2004-20240802-en

blackmoon banker discovery persistence privilege_escalation trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  88bc21f82c5a4e6574b3caf8f7b5a6169d0ed336476fd539cae6ee13eadc01ce
- Size
  
  1.8MB
- MD5
  
  7fa5282db8a98340220419a8787543a7
- SHA1
  
  8f61f823d951b1748393845504b833e881b15693
- SHA256
  
  88bc21f82c5a4e6574b3caf8f7b5a6169d0ed336476fd539cae6ee13eadc01ce
- SHA512
  
  8c73528f1391966670a4bd9e21a492f3249276b0e2bc81138a9c34edb02c79f254cd76743f7bf5ba07e9b3e9979d5bc9d71fb5738324b9eb6154477fb92a29d7
- SSDEEP
  
  24576:tr0TxazTID9UhQtRlA6Jz7kzSRciXSD3FbbBN/IyZJbOOEHqBh3SWgSklWNyK:tZzED7tRX8SWwWpNN/IyjEOBST1WNyK
Score

10^/10

blackmoon banker discovery persistence privilege_escalation trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoverypersistenceprivilege_escalationtrojanupx

behavioral2

blackmoonbankerdiscoverypersistenceprivilege_escalationtrojanupx

© 2018-2025

Terms | Privacy