Overview

overview

10

Static

static

7

f1c1a0145b...b6.exe

windows7-x64

10

f1c1a0145b...b6.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f1c1a0145bbf231c4866d43ec8180ca10c50f54bb72ddd3ed068d90b36b429b6

  • Size

    122KB

  • Sample

    241009-flbv5sthjc

  • MD5

    92f110f3c314e971c03e931344480466

  • SHA1

    bf2ca29a81820bd364846b3533aaf431dc23cea6

  • SHA256

    f1c1a0145bbf231c4866d43ec8180ca10c50f54bb72ddd3ed068d90b36b429b6

  • SHA512

    492bfdaa99d0e727c1d6b5ead75954e2a4ffdc5d819db5244347f3bd98d2043492bdf9b0e065eaa89f299a081cfda22d5cf80db0376b6a5b57205fc799387821

  • SSDEEP

    1536:7UdrF741HktQ5Xn1go9i/1KTINXA1lf3WoS:OF741h579idDNelfL

Score
10/10
blackmoongh0strataspackv2bankerdiscoveryrattrojanvmprotect

Malware Config

Targets

    • Target

      f1c1a0145bbf231c4866d43ec8180ca10c50f54bb72ddd3ed068d90b36b429b6

    • Size

      122KB

    • MD5

      92f110f3c314e971c03e931344480466

    • SHA1

      bf2ca29a81820bd364846b3533aaf431dc23cea6

    • SHA256

      f1c1a0145bbf231c4866d43ec8180ca10c50f54bb72ddd3ed068d90b36b429b6

    • SHA512

      492bfdaa99d0e727c1d6b5ead75954e2a4ffdc5d819db5244347f3bd98d2043492bdf9b0e065eaa89f299a081cfda22d5cf80db0376b6a5b57205fc799387821

    • SSDEEP

      1536:7UdrF741HktQ5Xn1go9i/1KTINXA1lf3WoS:OF741h579idDNelfL

    Score
    10/10
    blackmoongh0stratbankerdiscoveryrattrojanvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Downloads MZ/PE file

    • Modifies RDP port number used by Windows

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks