blackmoon | 1c635781f632788e1cbb592417190c4f529bd3de9949dfb5d23fe7fe430f5131 | Triage

Submit
Reports

Overview

overview

Static

static

9678876cc6...18.exe

windows7-x64

9678876cc6...18.exe

windows10-2004-x64

Sharing

General

Target

9678876cc6481b3f57f3778436e76c38_JaffaCakes118
Size

208KB
Sample

241124-w6wdaasqax
MD5

9678876cc6481b3f57f3778436e76c38
SHA1

00bbed77a9d5c1a38c0ec2d6db023541d94d10ee
SHA256

1c635781f632788e1cbb592417190c4f529bd3de9949dfb5d23fe7fe430f5131
SHA512

a070cc2f65569b0c526779a946508f4912830fae7445105bd2f98cd0c8980f9099741f7d0fa90e3d1ef8964c9c0c4c62106c2c47f27ef8d57b8081d7bf6f17c5
SSDEEP

3072:O41QolPNxfoHLF7AtLgAFtoOMu0xwYHUVCCstVXznQn4ytyPthv:O4QolffoHLFUyAAOj0F9C8E4lHv

Score

10^/10

blackmoon banker discovery persistence trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

9678876cc6481b3f57f3778436e76c38_JaffaCakes118.exe

Resource

win7-20240903-en

blackmoon banker discovery persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

9678876cc6481b3f57f3778436e76c38_JaffaCakes118.exe

Resource

win10v2004-20241007-en

blackmoon banker discovery persistence trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  9678876cc6481b3f57f3778436e76c38_JaffaCakes118
- Size
  
  208KB
- MD5
  
  9678876cc6481b3f57f3778436e76c38
- SHA1
  
  00bbed77a9d5c1a38c0ec2d6db023541d94d10ee
- SHA256
  
  1c635781f632788e1cbb592417190c4f529bd3de9949dfb5d23fe7fe430f5131
- SHA512
  
  a070cc2f65569b0c526779a946508f4912830fae7445105bd2f98cd0c8980f9099741f7d0fa90e3d1ef8964c9c0c4c62106c2c47f27ef8d57b8081d7bf6f17c5
- SSDEEP
  
  3072:O41QolPNxfoHLF7AtLgAFtoOMu0xwYHUVCCstVXznQn4ytyPthv:O4QolffoHLFUyAAOj0F9C8E4lHv
Score

10^/10

blackmoon banker discovery persistence trojan
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoverypersistencetrojan

behavioral2

blackmoonbankerdiscoverypersistencetrojan

© 2018-2025

Terms | Privacy