blackmoon | 0536b23475724d6fafc2a6b393bb6ae2f8f1180bb397298bc3895f1a5d2023fa | Triage

Submit
Reports

Overview

overview

Static

static

7

0536b23475...fa.exe

windows7-x64

0536b23475...fa.exe

windows10-2004-x64

Sharing

General

Target

0536b23475724d6fafc2a6b393bb6ae2f8f1180bb397298bc3895f1a5d2023fa
Size

109KB
Sample

240919-gyadhsvcrj
MD5

fd5539ecd50445a06dae98448a59ae41
SHA1

f8da2676557f7963de2a7a66bdc15f2f13f27946
SHA256

0536b23475724d6fafc2a6b393bb6ae2f8f1180bb397298bc3895f1a5d2023fa
SHA512

3e8ff1844eaed3c9f0a1462311e89d18f6d76cb5fb90d838e80c5e670ccc5adbe8147287f5866e5bec6113687930f91b78e0c8a6805d36e954ac4297f8b79178
SSDEEP

1536:ibfzM6RLWvPcbSar6LKGJUk2+bbYrBcL5uQW/DrUnQI00Je:WMcWvEeBvbbYFcNuQGPJw

Score

10^/10

blackmoon aspackv2 banker discovery trojan vmprotect

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

0536b23475724d6fafc2a6b393bb6ae2f8f1180bb397298bc3895f1a5d2023fa.exe

Resource

win7-20240729-en

blackmoon banker discovery trojan vmprotect

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

0536b23475724d6fafc2a6b393bb6ae2f8f1180bb397298bc3895f1a5d2023fa.exe

Resource

win10v2004-20240802-en

blackmoon banker discovery trojan vmprotect

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  0536b23475724d6fafc2a6b393bb6ae2f8f1180bb397298bc3895f1a5d2023fa
- Size
  
  109KB
- MD5
  
  fd5539ecd50445a06dae98448a59ae41
- SHA1
  
  f8da2676557f7963de2a7a66bdc15f2f13f27946
- SHA256
  
  0536b23475724d6fafc2a6b393bb6ae2f8f1180bb397298bc3895f1a5d2023fa
- SHA512
  
  3e8ff1844eaed3c9f0a1462311e89d18f6d76cb5fb90d838e80c5e670ccc5adbe8147287f5866e5bec6113687930f91b78e0c8a6805d36e954ac4297f8b79178
- SSDEEP
  
  1536:ibfzM6RLWvPcbSar6LKGJUk2+bbYrBcL5uQW/DrUnQI00Je:WMcWvEeBvbbYFcNuQGPJw
Score

10^/10

blackmoon banker discovery trojan vmprotect
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoverytrojanvmprotect

behavioral2

blackmoonbankerdiscoverytrojanvmprotect

© 2018-2025

Terms | Privacy