banload | b141ab85d517a27d05b3062622ee40da3de8af75c699e44e3f34c54a9257ae77 | Triage

Submit
Reports

Overview

overview

Static

static

3

b141ab85d5...77.dll

windows7-x64

b141ab85d5...77.dll

windows10-2004-x64

Sharing

General

Target

b141ab85d517a27d05b3062622ee40da3de8af75c699e44e3f34c54a9257ae77
Size

2.3MB
Sample

240926-lvz7zstbnc
MD5

53cd9e22e24a5f04b676d03c4354ecaa
SHA1

a6bf13724a2de2b7c6a79f5574370daec2fff6a4
SHA256

b141ab85d517a27d05b3062622ee40da3de8af75c699e44e3f34c54a9257ae77
SHA512

8d44a18521b6f09c14a56496e8d68864a7a278e3cab4dae717ca3a74c9e0de8c7c2a4b98e1cbcab88c9b8e98333af396bbd03247b42ef6d440e12173f16a1b7a
SSDEEP

49152:dDUPp6v4xTkL/xfJJvHSVYdCdme3gEAFQKzRP:dDJiKCdmeQEcQKd

Score

10^/10

banload blackmoon banker discovery downloader dropper evasion trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b141ab85d517a27d05b3062622ee40da3de8af75c699e44e3f34c54a9257ae77.dll

Resource

win7-20240903-en

banload blackmoon banker discovery downloader dropper evasion trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

b141ab85d517a27d05b3062622ee40da3de8af75c699e44e3f34c54a9257ae77.dll

Resource

win10v2004-20240802-en

banload blackmoon banker discovery downloader dropper evasion trojan upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  b141ab85d517a27d05b3062622ee40da3de8af75c699e44e3f34c54a9257ae77
- Size
  
  2.3MB
- MD5
  
  53cd9e22e24a5f04b676d03c4354ecaa
- SHA1
  
  a6bf13724a2de2b7c6a79f5574370daec2fff6a4
- SHA256
  
  b141ab85d517a27d05b3062622ee40da3de8af75c699e44e3f34c54a9257ae77
- SHA512
  
  8d44a18521b6f09c14a56496e8d68864a7a278e3cab4dae717ca3a74c9e0de8c7c2a4b98e1cbcab88c9b8e98333af396bbd03247b42ef6d440e12173f16a1b7a
- SSDEEP
  
  49152:dDUPp6v4xTkL/xfJJvHSVYdCdme3gEAFQKzRP:dDJiKCdmeQEcQKd
Score

10^/10

banload blackmoon banker discovery downloader dropper evasion trojan upx
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

banloadblackmoonbankerdiscoverydownloaderdropperevasiontrojanupx

behavioral2

banloadblackmoonbankerdiscoverydownloaderdropperevasiontrojanupx

© 2018-2024

Terms | Privacy