Overview

overview

10

Static

static

3

installer_S11.18.exe

windows7-x64

10

installer_S11.18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    installer_S11.18.exe.vir

  • Size

    2.9MB

  • Sample

    241120-rpcgmaxend

  • MD5

    f97afe2c15fb0d24f9ec74c73e19344a

  • SHA1

    a081dad4c0ca356b20011fa5590ca35bf32aff2f

  • SHA256

    6d0119ee048b00c7d167a6c63f288911d8c5fd5334c1d50135896834bd79756a

  • SHA512

    dcbf04778d11b24fd794549a4a4d800b35c31c51aadcda4240a237159ad550efbaa541efe917e1a3647c454a15e3d3af06f0663aba7241a8103f8366833a4f77

  • SSDEEP

    49152:NOpptq2d346JrPO+tPvx0ANe1vsG+cfx52vktBwEITz83zo6TDOkDbnYrpILi2re:Nq3/jO+tBLE1UG+UEktB9I3ylZPS

Score
10/10
blackmoonbankerdiscoveryevasiontrojanupx

Malware Config

Targets

    • Target

      installer_S11.18.exe.vir

    • Size

      2.9MB

    • MD5

      f97afe2c15fb0d24f9ec74c73e19344a

    • SHA1

      a081dad4c0ca356b20011fa5590ca35bf32aff2f

    • SHA256

      6d0119ee048b00c7d167a6c63f288911d8c5fd5334c1d50135896834bd79756a

    • SHA512

      dcbf04778d11b24fd794549a4a4d800b35c31c51aadcda4240a237159ad550efbaa541efe917e1a3647c454a15e3d3af06f0663aba7241a8103f8366833a4f77

    • SSDEEP

      49152:NOpptq2d346JrPO+tPvx0ANe1vsG+cfx52vktBwEITz83zo6TDOkDbnYrpILi2re:Nq3/jO+tBLE1UG+UEktB9I3ylZPS

    Score
    10/10
    blackmoonbankerdiscoveryevasiontrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UAC bypass

      evasiontrojan

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks