blackmoon | 5e059206c1c9b72d51c682e0d17dff702a8065876167853040bd512bdc290f52

General

Target

5e059206c1c9b72d51c682e0d17dff702a8065876167853040bd512bdc290f52.exe
Size

74KB
Sample

241125-m51ryazmgm
MD5

fb8ae844603ef495e58d2e1c121edcc6
SHA1

5ac01aa1f08ffb44b1ac9e8bdb5d07aa1df2a748
SHA256

5e059206c1c9b72d51c682e0d17dff702a8065876167853040bd512bdc290f52
SHA512

9bc93166bd4439b00ec63091ddb70bdb571b25645f2a1891f3aa43bb3ede938c33094709abbbc8b946fbd8c48c92c52dc83c2ff753a65ee0a1c9b41b3e4ffca0
SSDEEP

1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8r:VfIS2vhLoz5sQkqgjg1YWZfoutr

Score

10^/10

Malware Config

Targets

- Target
  
  5e059206c1c9b72d51c682e0d17dff702a8065876167853040bd512bdc290f52.exe
- Size
  
  74KB
- MD5
  
  fb8ae844603ef495e58d2e1c121edcc6
- SHA1
  
  5ac01aa1f08ffb44b1ac9e8bdb5d07aa1df2a748
- SHA256
  
  5e059206c1c9b72d51c682e0d17dff702a8065876167853040bd512bdc290f52
- SHA512
  
  9bc93166bd4439b00ec63091ddb70bdb571b25645f2a1891f3aa43bb3ede938c33094709abbbc8b946fbd8c48c92c52dc83c2ff753a65ee0a1c9b41b3e4ffca0
- SSDEEP
  
  1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8r:VfIS2vhLoz5sQkqgjg1YWZfoutr
Score

10^/10

blackmoon banker discovery trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2