Extracted

• • Target

    9874885c84aff39e72bec9565ff5018e2a4ff90771e8d5eec70f7b381c9dbdb5N

  • Size

    3.6MB

  • MD5

    2637b46b336ad1cc341d987cb0d7d8d0

  • SHA1

    6861531b4795ff56837ca77c938b24fd3cecd20d

  • SHA256

    9874885c84aff39e72bec9565ff5018e2a4ff90771e8d5eec70f7b381c9dbdb5

  • SHA512

    e0a765752f74f6b08f8ce9d8830d288aa696c0170173693b282f00665d270e31b1479448ee0ac6bc5219509a3c17cfb928d48f34026f665e5529101a516ae657

  • SSDEEP

    98304:Dg2KK3z9OP+9Rqc7oaZjco177GBfWeLwlYwEXU:E2KKjQ+9RZ7uoZGBfWx

  Score

  10^/10

  blackmoongozixmrigbankerdiscoveryevasionisfbminerpersistencespywarestealertrojanupx

  • Blackmoon family

    blackmoon

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • UAC bypass

    evasiontrojan

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2