Extracted

• • Target

    61bf80cb8beb60482b5a27ca37f8777f7bb8ca0e6c0bf2cf90a0f1e627acb1f9N

  • Size

    4.2MB

  • MD5

    bc5d833c71dc09b5caf6eaeedd309d50

  • SHA1

    3cd5a33c31905b3a5be185c346bfb839150e8e54

  • SHA256

    61bf80cb8beb60482b5a27ca37f8777f7bb8ca0e6c0bf2cf90a0f1e627acb1f9

  • SHA512

    50d0a424c81a8093f713da30f919a2f047b96ecbde588b4b1f49ce010c9bb978560f76e20c7a4332c3353d9180ddb76d2353b2c24c92e51aefeaf169405a9ebb

  • SSDEEP

    98304:Dg2KK3z9OP+9Rqc7nILa0az2jjSNLdDSznsO5fUTVf1+R3LzyZB:E2KKjQ+9RZ7nD23Sj4z5fURf8ZLzyZB

  Score

  10^/10

  blackmoongozixmrigbankerdiscoveryevasionisfbminerpersistencespywarestealertrojanupx

  • Blackmoon family

    blackmoon

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • UAC bypass

    evasiontrojan

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2