Overview

overview

10

Static

static

10

813fb50d53...4a.exe

windows7-x64

7

813fb50d53...4a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    813fb50d53dfb907563422867fc86c92205da4270601864112a9f5f0cd2d8c4a

  • Size

    800KB

  • Sample

    240908-1a7tnawdnj

  • MD5

    3454759bcf05521d84822ba5d16614f7

  • SHA1

    c3bc8cd4c8dcb2897b653ede3fa209401d64fbd3

  • SHA256

    813fb50d53dfb907563422867fc86c92205da4270601864112a9f5f0cd2d8c4a

  • SHA512

    450a5a767801199fc9fdde39c3b78cdd85b4297d319dd9807a73c8d14b5ffb98330319a84a8b20fc834af4eb05663ba8d163302f7d2b1af0ef47e5348186ba95

  • SSDEEP

    3072:8ewG8fbqPsdE2NTlHwLTiQ1clyZt5m8v2pbz8tRgw9qnYR/11Q:8ewG8fssdE0TlHOTimghVBERZ9qnY

Score
10/10
blackmoonbankerdiscoverytrojanupx

Malware Config

Targets

    • Target

      813fb50d53dfb907563422867fc86c92205da4270601864112a9f5f0cd2d8c4a

    • Size

      800KB

    • MD5

      3454759bcf05521d84822ba5d16614f7

    • SHA1

      c3bc8cd4c8dcb2897b653ede3fa209401d64fbd3

    • SHA256

      813fb50d53dfb907563422867fc86c92205da4270601864112a9f5f0cd2d8c4a

    • SHA512

      450a5a767801199fc9fdde39c3b78cdd85b4297d319dd9807a73c8d14b5ffb98330319a84a8b20fc834af4eb05663ba8d163302f7d2b1af0ef47e5348186ba95

    • SSDEEP

      3072:8ewG8fbqPsdE2NTlHwLTiQ1clyZt5m8v2pbz8tRgw9qnYR/11Q:8ewG8fssdE0TlHOTimghVBERZ9qnY

    Score
    10/10
    discoveryupxblackmoonbankertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks