Overview

overview

10

Static

static

3

FYefDDd/pGBQFXr.exe

windows7-x64

10

FYefDDd/pGBQFXr.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    FYefDDd.rar

  • Size

    26.8MB

  • Sample

    240820-sjaaraydpa

  • MD5

    3a04e0d549d65b1365df952989a1643e

  • SHA1

    e36852725eafbf5d56dad61c6feb7050c7177e9e

  • SHA256

    0585ca3526ed8d1771c880a8194c474fe3602487845871782dbd70b72fce4b2b

  • SHA512

    8969647d4c286a17d158c249f7946adfd4476d795a649a046877f6a217972086f68dbbd0f127f3c4d2221f975fe651e3a26dfe301cf5b44951a1df7339f76e6e

  • SSDEEP

    786432:HsCTseUsMukQqnJHAJl8gVdt7f25jBVofWHB:MC1Snhwx7tf2h8Wh

Score
10/10
blackmoonbankerdiscoverytrojan

Malware Config

Targets

    • Target

      FYefDDd/pGBQFXr.exe

    • Size

      129KB

    • MD5

      7ea6be30e745e9556c017439c5e83273

    • SHA1

      4e36ae4f8bb1c6a438f8cc6952ec840415b5d9f2

    • SHA256

      5a3e4e68ffa8e8796ec0ff3d01473ceafa070dc533a1c268d073ee7abd6c8021

    • SHA512

      0a17f4e6e60932282cb28823a77c5ebef7a8c8ee472f00c9ef9eebb0481886647faa698f2c2e193db095c6467f6e41307aff96030fadd3072ba700c1e1e45724

    • SSDEEP

      1536:SVgl8I1rieO+EEDmKUKbQJnH8BYOuKIawQzWbfTMxW6oaZd7/Pxr:Vl8dsEKbqcBYOhIa6LTMaazLxr

    Score
    10/10
    blackmoonbankerdiscoverytrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks