Overview

overview

10

Static

static

3

f5e49865f3...e3.exe

windows7-x64

10

f5e49865f3...e3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5e49865f30dbd20e7c0ae7aded53b1fa312ba645569551daaca2aa4513ba1e3

  • Size

    1.8MB

  • Sample

    241121-ka5raszphs

  • MD5

    f3d5b4a5d2bd7660bfe3ee1de07d0545

  • SHA1

    e8d638898d61299ef8709e7f630b158b017b2e9e

  • SHA256

    f5e49865f30dbd20e7c0ae7aded53b1fa312ba645569551daaca2aa4513ba1e3

  • SHA512

    e6dc33f2fe4e73f3f1319d67e1cf79d86662248335a2f778d102c92c05adee1688d53fc42355b7b4296e47612d4b34102ae2bd4192a2fab52617049a6f8f0086

  • SSDEEP

    24576:d1c++iVeHoazxWXwmsGUj2cJiqrlEPZj7C7Nl6rdIKoH4xr6V:d/VEzx0sGUJHxE4NlkpxOV

Score
10/10
blackmoonbankerdiscoveryevasiontrojanupx

Malware Config

Targets

    • Target

      f5e49865f30dbd20e7c0ae7aded53b1fa312ba645569551daaca2aa4513ba1e3

    • Size

      1.8MB

    • MD5

      f3d5b4a5d2bd7660bfe3ee1de07d0545

    • SHA1

      e8d638898d61299ef8709e7f630b158b017b2e9e

    • SHA256

      f5e49865f30dbd20e7c0ae7aded53b1fa312ba645569551daaca2aa4513ba1e3

    • SHA512

      e6dc33f2fe4e73f3f1319d67e1cf79d86662248335a2f778d102c92c05adee1688d53fc42355b7b4296e47612d4b34102ae2bd4192a2fab52617049a6f8f0086

    • SSDEEP

      24576:d1c++iVeHoazxWXwmsGUj2cJiqrlEPZj7C7Nl6rdIKoH4xr6V:d/VEzx0sGUJHxE4NlkpxOV

    Score
    10/10
    blackmoonbankerdiscoveryevasiontrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UAC bypass

      evasiontrojan

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks