blackmoon | a15d886922a4db1684ade756c2e8a58a5c522b6bcd45da8ec83227b991195704 | Triage

Submit
Reports

Overview

overview

Static

static

5

a15d886922...04.exe

windows7-x64

a15d886922...04.exe

windows10-2004-x64

Sharing

General

Target

a15d886922a4db1684ade756c2e8a58a5c522b6bcd45da8ec83227b991195704
Size

1.8MB
Sample

241121-jsrrqavjhq
MD5

fd2d3d490ab7f425f93faacaa42bc4ed
SHA1

bcd1ba547349445839d32313a9ee0e6382eb59a4
SHA256

a15d886922a4db1684ade756c2e8a58a5c522b6bcd45da8ec83227b991195704
SHA512

d12c1c73f20814078b81e02d64028ed7776adeda7f4b7671cc9f51d52321e7a4fed311c3599ad6f1fb106abf234d5463c5f117c3a4f36eafe8d7389a27e3474a
SSDEEP

24576:ypqVQjnsmIY7sts7X0TB7CoexKY5JEABpp7fw8tThRBsyeivYqazS8d8JW:nQLIYwK0V7CoYKYDESLw81RyyedqazSi

Score

10^/10

blackmoon banker discovery trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

a15d886922a4db1684ade756c2e8a58a5c522b6bcd45da8ec83227b991195704.exe

Resource

win7-20240903-en

blackmoon banker discovery trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

a15d886922a4db1684ade756c2e8a58a5c522b6bcd45da8ec83227b991195704.exe

Resource

win10v2004-20241007-en

blackmoon banker discovery trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  a15d886922a4db1684ade756c2e8a58a5c522b6bcd45da8ec83227b991195704
- Size
  
  1.8MB
- MD5
  
  fd2d3d490ab7f425f93faacaa42bc4ed
- SHA1
  
  bcd1ba547349445839d32313a9ee0e6382eb59a4
- SHA256
  
  a15d886922a4db1684ade756c2e8a58a5c522b6bcd45da8ec83227b991195704
- SHA512
  
  d12c1c73f20814078b81e02d64028ed7776adeda7f4b7671cc9f51d52321e7a4fed311c3599ad6f1fb106abf234d5463c5f117c3a4f36eafe8d7389a27e3474a
- SSDEEP
  
  24576:ypqVQjnsmIY7sts7X0TB7CoexKY5JEABpp7fw8tThRBsyeivYqazS8d8JW:nQLIYwK0V7CoYKYDESLw81RyyedqazSi
Score

10^/10

blackmoon banker discovery trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoverytrojanupx

behavioral2

blackmoonbankerdiscoverytrojanupx

© 2018-2025

Terms | Privacy