Overview

overview

10

Static

static

10

838771a802...7e.exe

windows7-x64

10

838771a802...7e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    838771a802cff34cdfb9b04c4fa14eb3bd796341696746e3fe8f48b015b10d7e

  • Size

    2.8MB

  • Sample

    240929-nhyvhawama

  • MD5

    a8fe411c68adcd42d0270b015dd36dfd

  • SHA1

    d446c7dc5cd155b66bb7eff4b687cdbb0e5b28f0

  • SHA256

    838771a802cff34cdfb9b04c4fa14eb3bd796341696746e3fe8f48b015b10d7e

  • SHA512

    e6be91ac4d23f1efaf61b1398ea15a3d252f8df2e4e673d7bb385b667a26e3092a50d35a4e13985f722ad10a916df3e928f1d1bf3e5c2671bfe3c63bf0c1f8dd

  • SSDEEP

    49152:nF+P9VgqrzbfDULyOPtjN/lXekpomFsEB7yOrRBST1WjyK:F+PfRELyOhN/lXe4FsNyOWWK

Score
10/10
blackmoonbankerdiscoverypersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      838771a802cff34cdfb9b04c4fa14eb3bd796341696746e3fe8f48b015b10d7e

    • Size

      2.8MB

    • MD5

      a8fe411c68adcd42d0270b015dd36dfd

    • SHA1

      d446c7dc5cd155b66bb7eff4b687cdbb0e5b28f0

    • SHA256

      838771a802cff34cdfb9b04c4fa14eb3bd796341696746e3fe8f48b015b10d7e

    • SHA512

      e6be91ac4d23f1efaf61b1398ea15a3d252f8df2e4e673d7bb385b667a26e3092a50d35a4e13985f722ad10a916df3e928f1d1bf3e5c2671bfe3c63bf0c1f8dd

    • SSDEEP

      49152:nF+P9VgqrzbfDULyOPtjN/lXekpomFsEB7yOrRBST1WjyK:F+PfRELyOhN/lXe4FsNyOWWK

    Score
    10/10
    blackmoonbankerdiscoverypersistenceprivilege_escalationtrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks