General

  • Target

    6366e440e597e6eaf8fdbbd0ef8205d4641a422a81b1fff275242c7ea9fc5969

  • Size

    15.7MB

  • Sample

    241018-zdx8ysxapd

  • MD5

    2f6dcfba4fad5ea3709acf76171329ba

  • SHA1

    ce4610a9c91ebef965ad3926123d3e6aa045760a

  • SHA256

    6366e440e597e6eaf8fdbbd0ef8205d4641a422a81b1fff275242c7ea9fc5969

  • SHA512

    4b4f9a6ffa0461bb33e183608ef1827f3b5e7636d67f0d7855cfa5a9efc02ffae24bf9e6163c2381b72379e269ed0fc45799f4483ec84331cfe6b4f80f86a3ca

  • SSDEEP

    393216:xOEzJxXHOlPLJqeXckzwGT3XWt8xSDsCVXMb5NL9py991CgK+Vw:xOypultq6HwMjxSQC2Npyf0gc

Malware Config

Targets

    • Target

      6366e440e597e6eaf8fdbbd0ef8205d4641a422a81b1fff275242c7ea9fc5969

    • Size

      15.7MB

    • MD5

      2f6dcfba4fad5ea3709acf76171329ba

    • SHA1

      ce4610a9c91ebef965ad3926123d3e6aa045760a

    • SHA256

      6366e440e597e6eaf8fdbbd0ef8205d4641a422a81b1fff275242c7ea9fc5969

    • SHA512

      4b4f9a6ffa0461bb33e183608ef1827f3b5e7636d67f0d7855cfa5a9efc02ffae24bf9e6163c2381b72379e269ed0fc45799f4483ec84331cfe6b4f80f86a3ca

    • SSDEEP

      393216:xOEzJxXHOlPLJqeXckzwGT3XWt8xSDsCVXMb5NL9py991CgK+Vw:xOypultq6HwMjxSQC2Npyf0gc

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks