blackmoon | e32f01fcc3f945658bd9eb098fb7cfeba3397f4f593f076231f576af3861a4af

General

Target

e32f01fcc3f945658bd9eb098fb7cfeba3397f4f593f076231f576af3861a4af.exe
Size

435KB
Sample

241119-whkxmsygrc
MD5

11e8719f01a46414f67943c01db46a3f
SHA1

473c59f47093ab698f4cd1bc19a145b645ab4c39
SHA256

e32f01fcc3f945658bd9eb098fb7cfeba3397f4f593f076231f576af3861a4af
SHA512

2e675f86bb21de3e6cee805bed7d22afaf1ab9d2cff8bff901228c957bbdffd7ac6ecb3f70938f8280e81f2fe995871f13a811b6757551951990fc01e90474ef
SSDEEP

3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/w/yjUuMx8kI:q0m2FqgDAuSbAXKfz0c0sUIJHk4w/yWs

Score

10^/10

Malware Config

Targets

- Target
  
  e32f01fcc3f945658bd9eb098fb7cfeba3397f4f593f076231f576af3861a4af.exe
- Size
  
  435KB
- MD5
  
  11e8719f01a46414f67943c01db46a3f
- SHA1
  
  473c59f47093ab698f4cd1bc19a145b645ab4c39
- SHA256
  
  e32f01fcc3f945658bd9eb098fb7cfeba3397f4f593f076231f576af3861a4af
- SHA512
  
  2e675f86bb21de3e6cee805bed7d22afaf1ab9d2cff8bff901228c957bbdffd7ac6ecb3f70938f8280e81f2fe995871f13a811b6757551951990fc01e90474ef
- SSDEEP
  
  3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/w/yjUuMx8kI:q0m2FqgDAuSbAXKfz0c0sUIJHk4w/yWs
Score

10^/10

blackmoon banker discovery trojan
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2