Extracted

• • Target

    10e6863438c559243979cfaf3e750d3244dbb7588dff6f12565cc8aa71c9b44dN

  • Size

    3.8MB

  • MD5

    6adf7c0d3e770b9962d9c976abd5d660

  • SHA1

    3c595298d93f1bc8c456f06c517097aa98275974

  • SHA256

    10e6863438c559243979cfaf3e750d3244dbb7588dff6f12565cc8aa71c9b44d

  • SHA512

    9a7ce9b89a26643b5e5dd24713228c0280dd8de1fcf88286c4e84940597f98ab74499701492433bbe80cb23c5288fa3540012f971a996a885f27fad8145c2f12

  • SSDEEP

    98304:Dg2KK3z9OP+9Rqc7h2BSUXfcrRk0kq4DfT:E2KKjQ+9RZ7lr23r

  Score

  10^/10

  blackmoongozixmrigbankerdiscoveryevasionisfbminerpersistencespywarestealertrojanupx

  • Blackmoon family

    blackmoon

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • UAC bypass

    evasiontrojan

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2