Overview

overview

10

Static

static

10

9f8cea1485...3N.exe

windows7-x64

10

9f8cea1485...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N

  • Size

    366KB

  • Sample

    241002-qrdxssybpq

  • MD5

    9b3b6d1b9f2949abc72e55d0556905b0

  • SHA1

    263263ea19b86182ca068ae385fd9e4ba59b45a2

  • SHA256

    9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363

  • SHA512

    2db3873955868c959055873bce5d053d6925c9e3750f4b1362d50082d2cf2e13f82caa77af49969b5687a2b60879e3511d23e53e0920498d9346288d162d3b7c

  • SSDEEP

    6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1W:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1W

Score
10/10
blackmoonbankerdiscoverytrojan

Malware Config

Targets

    • Target

      9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N

    • Size

      366KB

    • MD5

      9b3b6d1b9f2949abc72e55d0556905b0

    • SHA1

      263263ea19b86182ca068ae385fd9e4ba59b45a2

    • SHA256

      9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363

    • SHA512

      2db3873955868c959055873bce5d053d6925c9e3750f4b1362d50082d2cf2e13f82caa77af49969b5687a2b60879e3511d23e53e0920498d9346288d162d3b7c

    • SSDEEP

      6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1W:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1W

    Score
    10/10
    blackmoonbankerdiscoverytrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks