blackmoon | 008356e7c398ebbe5612fefeb27b4ee2b67bdae280838aaf4d88352fa0318695

General

Target

008356e7c398ebbe5612fefeb27b4ee2b67bdae280838aaf4d88352fa0318695N
Size

93KB
Sample

240921-w3w6eawfng
MD5

ac100195123fcf5fed1b212124102b50
SHA1

9692ebed29fd26af2bb165400aac6083727bafff
SHA256

008356e7c398ebbe5612fefeb27b4ee2b67bdae280838aaf4d88352fa0318695
SHA512

70e47851cf2a91d3f6e01cd93041472e468accdf9caf57da2168d844147d0346cd87fbf64aa0eee24d833a2cf9da1ed61441b913053f35805ce1b44423d57d6a
SSDEEP

1536:Q/vTGudTe5k4Lo8KI2Z4yNcR5Mpk7WO9f2zXGYxTIx9JL8IoQ6CqZphkx:Q/bhOrBKIq4XR5Mpp+fw2CIx9JLYpkx

Score

10^/10

Malware Config

Targets

- Target
  
  008356e7c398ebbe5612fefeb27b4ee2b67bdae280838aaf4d88352fa0318695N
- Size
  
  93KB
- MD5
  
  ac100195123fcf5fed1b212124102b50
- SHA1
  
  9692ebed29fd26af2bb165400aac6083727bafff
- SHA256
  
  008356e7c398ebbe5612fefeb27b4ee2b67bdae280838aaf4d88352fa0318695
- SHA512
  
  70e47851cf2a91d3f6e01cd93041472e468accdf9caf57da2168d844147d0346cd87fbf64aa0eee24d833a2cf9da1ed61441b913053f35805ce1b44423d57d6a
- SSDEEP
  
  1536:Q/vTGudTe5k4Lo8KI2Z4yNcR5Mpk7WO9f2zXGYxTIx9JL8IoQ6CqZphkx:Q/bhOrBKIq4XR5Mpp+fw2CIx9JLYpkx
Score

10^/10

blackmoon banker discovery trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon, KrBanker

Detect Blackmoon payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2