blackmoon | 48997abc7a5f99d6e78a2f557ba7190ff0abcac948952efbae6e29be6a9255fd

General

Target

48997abc7a5f99d6e78a2f557ba7190ff0abcac948952efbae6e29be6a9255fd.exe
Size

432KB
Sample

241124-w79x3ayqen
MD5

8f5487dff12ebb13dc64a3060cf062cf
SHA1

4390cb4381fecbd498b9cfd00a3d388855b3c2d3
SHA256

48997abc7a5f99d6e78a2f557ba7190ff0abcac948952efbae6e29be6a9255fd
SHA512

5bef3169928ae09d8c399cf6b95792a5fce487e31a943042d91ef195400f64001ed1c29666e6ec28710889575b4d7d839b61b0498ce852ca880cc5509019983c
SSDEEP

3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUB:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+2

Score

10^/10

Malware Config

Targets

- Target
  
  48997abc7a5f99d6e78a2f557ba7190ff0abcac948952efbae6e29be6a9255fd.exe
- Size
  
  432KB
- MD5
  
  8f5487dff12ebb13dc64a3060cf062cf
- SHA1
  
  4390cb4381fecbd498b9cfd00a3d388855b3c2d3
- SHA256
  
  48997abc7a5f99d6e78a2f557ba7190ff0abcac948952efbae6e29be6a9255fd
- SHA512
  
  5bef3169928ae09d8c399cf6b95792a5fce487e31a943042d91ef195400f64001ed1c29666e6ec28710889575b4d7d839b61b0498ce852ca880cc5509019983c
- SSDEEP
  
  3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUB:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+2
Score

10^/10

blackmoon banker discovery trojan
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2