blackmoon | b636f057ca4b8f48ee0278f3a61f4a56786e292db4b352c91c88de95a49c72a1 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

1811739659...18.exe

windows7-x64

1811739659...18.exe

windows10-2004-x64

Sharing

General

Target

1811739659ba90888a17593938aad7ca_JaffaCakes118
Size

147KB
Sample

241006-pkpkaaxhqg
MD5

1811739659ba90888a17593938aad7ca
SHA1

3d20d38e02aece1c72d7d98a95026eba6aa431df
SHA256

b636f057ca4b8f48ee0278f3a61f4a56786e292db4b352c91c88de95a49c72a1
SHA512

a277d33d42071e8c5ba9f92bae8981c3931590b4164974f470719786c2eaa051c7e1dda7f9a5d33fe5d91ae3c58ecc50cf3b8b2fb84b482213a91f3f09a10932
SSDEEP

3072:J5umPxBBtyyNeQemRTCghEkMgqtsbtlRW1wNZkaIHYvkoutV:jumPbyyNN9TCedqtsb3saNC+vkoSV

Score

10^/10

blackmoon banker defense_evasion discovery persistence trojan vmprotect

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1811739659ba90888a17593938aad7ca_JaffaCakes118.exe

Resource

win7-20240903-en

blackmoon banker defense_evasion discovery persistence trojan vmprotect

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

1811739659ba90888a17593938aad7ca_JaffaCakes118.exe

Resource

win10v2004-20240802-en

blackmoon banker defense_evasion discovery persistence trojan vmprotect

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  1811739659ba90888a17593938aad7ca_JaffaCakes118
- Size
  
  147KB
- MD5
  
  1811739659ba90888a17593938aad7ca
- SHA1
  
  3d20d38e02aece1c72d7d98a95026eba6aa431df
- SHA256
  
  b636f057ca4b8f48ee0278f3a61f4a56786e292db4b352c91c88de95a49c72a1
- SHA512
  
  a277d33d42071e8c5ba9f92bae8981c3931590b4164974f470719786c2eaa051c7e1dda7f9a5d33fe5d91ae3c58ecc50cf3b8b2fb84b482213a91f3f09a10932
- SSDEEP
  
  3072:J5umPxBBtyyNeQemRTCghEkMgqtsbtlRW1wNZkaIHYvkoutV:jumPbyyNN9TCedqtsb3saNC+vkoSV
Score

10^/10

blackmoon banker defense_evasion discovery persistence trojan vmprotect
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdefense_evasiondiscoverypersistencetrojanvmprotect

behavioral2

blackmoonbankerdefense_evasiondiscoverypersistencetrojanvmprotect

© 2018-2025

Terms | Privacy