Overview

overview

10

Static

static

1

9e1f849da1...dc.exe

windows7-x64

10

9e1f849da1...dc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e1f849da1d84be352974a30390b4030bf4852ec69f650a1533a3a090aa8fcdc

  • Size

    1.0MB

  • Sample

    241122-qasdvs1lgs

  • MD5

    39f66d49e4233bf1dfef254265bb7106

  • SHA1

    5f570e10026e6fde93bcd1e93c69796b48f7dd4c

  • SHA256

    9e1f849da1d84be352974a30390b4030bf4852ec69f650a1533a3a090aa8fcdc

  • SHA512

    7b52c2a52512f276aa8335f7c401ffb88fcdd74da54b798196aa1a5b84921ddaa1b44c2bf00ac05e19725bb5522a5a5a5e0bbb63b7709f89d8cde76372a7587d

  • SSDEEP

    12288:VD0jQa1iQWYkWDMZA/95zeFSqsarFossFFy2QPkfSHwQ0EHgbholN7Mwf/J0:VDsQa1iLYpDx/Hz01sFQYmZgloQm/J0

Score
10/10
blackmoonbankerdiscoveryevasiontrojanupx

Malware Config

Targets

    • Target

      9e1f849da1d84be352974a30390b4030bf4852ec69f650a1533a3a090aa8fcdc

    • Size

      1.0MB

    • MD5

      39f66d49e4233bf1dfef254265bb7106

    • SHA1

      5f570e10026e6fde93bcd1e93c69796b48f7dd4c

    • SHA256

      9e1f849da1d84be352974a30390b4030bf4852ec69f650a1533a3a090aa8fcdc

    • SHA512

      7b52c2a52512f276aa8335f7c401ffb88fcdd74da54b798196aa1a5b84921ddaa1b44c2bf00ac05e19725bb5522a5a5a5e0bbb63b7709f89d8cde76372a7587d

    • SSDEEP

      12288:VD0jQa1iQWYkWDMZA/95zeFSqsarFossFFy2QPkfSHwQ0EHgbholN7Mwf/J0:VDsQa1iLYpDx/Hz01sFQYmZgloQm/J0

    Score
    10/10
    blackmoonbankerdiscoveryevasiontrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UAC bypass

      evasiontrojan

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks