Overview

overview

10

Static

static

10

08659f2cc6...6a.exe

windows7-x64

10

08659f2cc6...6a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08659f2cc61c104f9eb6289bd07ae1a75bfce2425094026e0767f224805b976a.exe

  • Size

    407KB

  • Sample

    241123-w5lsfsznfx

  • MD5

    ea674bd1692f4fb8a0cd801bcef0d469

  • SHA1

    f422c27a1ab1c73d1eb426169eb858ead0184019

  • SHA256

    08659f2cc61c104f9eb6289bd07ae1a75bfce2425094026e0767f224805b976a

  • SHA512

    5ff2f47a7d23f6dfe38e79371c22fd2e0571a9a56dab5e87c9a79c4176840f6e6026264446768206ae7bd684fb8931cd86778c4592d3c9feebfbe31ca8cbc4ea

  • SSDEEP

    6144:K5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zIydenCU:K5/Q58drihGiLhmGNiZsx0B/zIkenCU

Score
10/10
blackmoonbankerdiscoverytrojanupx

Malware Config

Targets

    • Target

      08659f2cc61c104f9eb6289bd07ae1a75bfce2425094026e0767f224805b976a.exe

    • Size

      407KB

    • MD5

      ea674bd1692f4fb8a0cd801bcef0d469

    • SHA1

      f422c27a1ab1c73d1eb426169eb858ead0184019

    • SHA256

      08659f2cc61c104f9eb6289bd07ae1a75bfce2425094026e0767f224805b976a

    • SHA512

      5ff2f47a7d23f6dfe38e79371c22fd2e0571a9a56dab5e87c9a79c4176840f6e6026264446768206ae7bd684fb8931cd86778c4592d3c9feebfbe31ca8cbc4ea

    • SSDEEP

      6144:K5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zIydenCU:K5/Q58drihGiLhmGNiZsx0B/zIkenCU

    Score
    10/10
    blackmoonbankerdiscoverytrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks