Overview

overview

10

Static

static

3

0346f345f1...76.exe

windows7-x64

10

0346f345f1...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0346f345f16e7b839495a549c67e3606457382edcfb04574eb4f9d219ee7a376

  • Size

    4.5MB

  • Sample

    241123-jhcj2s1mgx

  • MD5

    55b01cee23328cb85bd994aa09c1dcdc

  • SHA1

    a2ec3efca50011cb01cd254c6a69537f7321e175

  • SHA256

    0346f345f16e7b839495a549c67e3606457382edcfb04574eb4f9d219ee7a376

  • SHA512

    575e534da990c25aedb188ca4a86025df59c3e937da5b1fe700bb9f56d8cd29e22e1d46ebba2ea0dcfebd8f0a78926cd8365ffb1ae1524a2f426ded498f4d532

  • SSDEEP

    98304:PQJDxAcHWNZflLRWPnq1adkZYZfc4vHP9Erm/:A7HEfVRH1fYZfc4fPWS

Score
10/10
blackmoonbankerbootkitdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      0346f345f16e7b839495a549c67e3606457382edcfb04574eb4f9d219ee7a376

    • Size

      4.5MB

    • MD5

      55b01cee23328cb85bd994aa09c1dcdc

    • SHA1

      a2ec3efca50011cb01cd254c6a69537f7321e175

    • SHA256

      0346f345f16e7b839495a549c67e3606457382edcfb04574eb4f9d219ee7a376

    • SHA512

      575e534da990c25aedb188ca4a86025df59c3e937da5b1fe700bb9f56d8cd29e22e1d46ebba2ea0dcfebd8f0a78926cd8365ffb1ae1524a2f426ded498f4d532

    • SSDEEP

      98304:PQJDxAcHWNZflLRWPnq1adkZYZfc4vHP9Erm/:A7HEfVRH1fYZfc4fPWS

    Score
    10/10
    blackmoonbankerbootkitdiscoverypersistencetrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks