blackmoon | 6131f6137485449cb0f06db7c3ab3b63b1c1194996cbe911f819d6e1d592879d

General

Target

6131f6137485449cb0f06db7c3ab3b63b1c1194996cbe911f819d6e1d592879dN.exe
Size

432KB
Sample

241124-brw12ssqck
MD5

2b5b05df13edf4365db93eb3f5825120
SHA1

1f9058c9ea15ccd423083d840393f76562ea6bd1
SHA256

6131f6137485449cb0f06db7c3ab3b63b1c1194996cbe911f819d6e1d592879d
SHA512

e00685b2118540be29fd7d8c74294938a9b42e0e1241101064792d403ec73f302d2ef30ccacc500b058c699822f33b1a3d1d0c0203ec088551920885b980a802
SSDEEP

3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUc:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+N

Score

10^/10

Malware Config

Targets

- Target
  
  6131f6137485449cb0f06db7c3ab3b63b1c1194996cbe911f819d6e1d592879dN.exe
- Size
  
  432KB
- MD5
  
  2b5b05df13edf4365db93eb3f5825120
- SHA1
  
  1f9058c9ea15ccd423083d840393f76562ea6bd1
- SHA256
  
  6131f6137485449cb0f06db7c3ab3b63b1c1194996cbe911f819d6e1d592879d
- SHA512
  
  e00685b2118540be29fd7d8c74294938a9b42e0e1241101064792d403ec73f302d2ef30ccacc500b058c699822f33b1a3d1d0c0203ec088551920885b980a802
- SSDEEP
  
  3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUc:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+N
Score

10^/10

blackmoon banker discovery trojan
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2