Overview

overview

10

Static

static

3

9a831f5297...79.exe

windows7-x64

10

9a831f5297...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9a831f52977e538dd52625ad2ec01477515421a06e65b43797b711a8e9d0e879

  • Size

    4.5MB

  • Sample

    241122-h4dhsswnbs

  • MD5

    24c61fa08cfe0b77871dcbcb2eba07fb

  • SHA1

    bf2bff68d85e2f597ae75f094735871f8eaebf45

  • SHA256

    9a831f52977e538dd52625ad2ec01477515421a06e65b43797b711a8e9d0e879

  • SHA512

    d0936eb085d75fdefc96285b701ec29bb34f0816c75fddd694bcf19cc5ee695b320aab3c7c7da7eab9b21706fb0ee3a59cf77ac647bee127a2ad9966c3ca7918

  • SSDEEP

    98304:LzEmxj99/wKZflLRWPnq1adkZYZfc4v7P9Nrm:pR9PfVRH1fYZfc4TPjS

Score
10/10
blackmoonbankerbootkitdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      9a831f52977e538dd52625ad2ec01477515421a06e65b43797b711a8e9d0e879

    • Size

      4.5MB

    • MD5

      24c61fa08cfe0b77871dcbcb2eba07fb

    • SHA1

      bf2bff68d85e2f597ae75f094735871f8eaebf45

    • SHA256

      9a831f52977e538dd52625ad2ec01477515421a06e65b43797b711a8e9d0e879

    • SHA512

      d0936eb085d75fdefc96285b701ec29bb34f0816c75fddd694bcf19cc5ee695b320aab3c7c7da7eab9b21706fb0ee3a59cf77ac647bee127a2ad9966c3ca7918

    • SSDEEP

      98304:LzEmxj99/wKZflLRWPnq1adkZYZfc4v7P9Nrm:pR9PfVRH1fYZfc4TPjS

    Score
    10/10
    blackmoonbankerbootkitdiscoverypersistencetrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks