blackmoon | c163e8b4f8d9e361660fc11d716d3be2a516050d959cc622a39c261908d51a92 | Triage

Submit
Reports

Overview

overview

Static

static

9c30034f5e...18.exe

windows7-x64

9c30034f5e...18.exe

windows10-2004-x64

Sharing

General

Target

9c30034f5e2c8d13ba82d0b5a0d69ece_JaffaCakes118
Size

4.9MB
Sample

241125-r9jfnsykfj
MD5

9c30034f5e2c8d13ba82d0b5a0d69ece
SHA1

78925b5a64140730568815f6bb6c55904fc71e75
SHA256

c163e8b4f8d9e361660fc11d716d3be2a516050d959cc622a39c261908d51a92
SHA512

e232a73040feea5bf9d6534bc9b4ff59fc018ba2c8405a27fbbfbaf4349f40eeaeceef850e2352bb6c622e2227a82dbd03949d43de3f8f3422d47d4a5ededa32
SSDEEP

98304:/62hftrzFsIr/fU/szcUM+f112HMd5hfagvRIbqMGyKUCz/4DBwbrM:/nFFr3UEzw+yswgE2UCz/4Dm

Score

10^/10

blackmoon banker discovery spyware stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

9c30034f5e2c8d13ba82d0b5a0d69ece_JaffaCakes118.exe

Resource

win7-20240903-en

blackmoon banker discovery spyware stealer trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

9c30034f5e2c8d13ba82d0b5a0d69ece_JaffaCakes118.exe

Resource

win10v2004-20241007-en

blackmoon banker discovery spyware stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  9c30034f5e2c8d13ba82d0b5a0d69ece_JaffaCakes118
- Size
  
  4.9MB
- MD5
  
  9c30034f5e2c8d13ba82d0b5a0d69ece
- SHA1
  
  78925b5a64140730568815f6bb6c55904fc71e75
- SHA256
  
  c163e8b4f8d9e361660fc11d716d3be2a516050d959cc622a39c261908d51a92
- SHA512
  
  e232a73040feea5bf9d6534bc9b4ff59fc018ba2c8405a27fbbfbaf4349f40eeaeceef850e2352bb6c622e2227a82dbd03949d43de3f8f3422d47d4a5ededa32
- SSDEEP
  
  98304:/62hftrzFsIr/fU/szcUM+f112HMd5hfagvRIbqMGyKUCz/4DBwbrM:/nFFr3UEzw+yswgE2UCz/4Dm
Score

10^/10

blackmoon banker discovery spyware stealer trojan
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoveryspywarestealertrojan

behavioral2

blackmoonbankerdiscoveryspywarestealertrojan

© 2018-2025

Terms | Privacy