Overview

overview

10

Static

static

3

157.exe

windows7-x64

10

157.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    157.exe

  • Size

    1.9MB

  • Sample

    241122-m98y4szjfv

  • MD5

    07c24fa99061341f54d447489136484f

  • SHA1

    d4f8df213dfd5defdef5e8a74b6d377b4e081da1

  • SHA256

    020ec9567c682568aeb929310399e171e71a61f05dd718e940dfbbd3739026ca

  • SHA512

    e7a9cee85e81ebc7e7a291b5252b1002a6adf157b6ebbad9b3bd73c7ecfa08d34f3ab2bf1aba43703f864083a957ecf934589da508177bfbcb8fdb0f2c8c6ac9

  • SSDEEP

    24576:PogCrOVMhbdWXkvIdPPF8pN0EtGXW3V+sLxdXJTbGTs3l:P4bnWPOb0EoXWddXJTbGk

Score
10/10
blackmoonbankerdiscoveryevasiontrojanupx

Malware Config

Targets

    • Target

      157.exe

    • Size

      1.9MB

    • MD5

      07c24fa99061341f54d447489136484f

    • SHA1

      d4f8df213dfd5defdef5e8a74b6d377b4e081da1

    • SHA256

      020ec9567c682568aeb929310399e171e71a61f05dd718e940dfbbd3739026ca

    • SHA512

      e7a9cee85e81ebc7e7a291b5252b1002a6adf157b6ebbad9b3bd73c7ecfa08d34f3ab2bf1aba43703f864083a957ecf934589da508177bfbcb8fdb0f2c8c6ac9

    • SSDEEP

      24576:PogCrOVMhbdWXkvIdPPF8pN0EtGXW3V+sLxdXJTbGTs3l:P4bnWPOb0EoXWddXJTbGk

    Score
    10/10
    blackmoonbankerdiscoveryevasiontrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UAC bypass

      evasiontrojan

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks