Overview

overview

10

Static

static

5

e2047a9df9...7N.exe

windows7-x64

10

e2047a9df9...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2047a9df925f44842bd69a434babfb5d3e358f09747d9debbede0a43e0f37b7N.exe

  • Size

    69KB

  • Sample

    241125-vtmd6stnhr

  • MD5

    ff6212c0a3a97ba292503b0527d6de20

  • SHA1

    592578884e585a4b46eb609061f6076525012f20

  • SHA256

    e2047a9df925f44842bd69a434babfb5d3e358f09747d9debbede0a43e0f37b7

  • SHA512

    241f06157be6a54461431840974d5e658ede0204ce65b919db996f01558a5400d892bae095e1321ce35dc0dc7e694be2aec48f3fe2f7e44a869b7e7d6267c093

  • SSDEEP

    1536:TPyr5BWPJgzJrQsA4MJ8SS5gq9a2pJ+jZOb4W9nouy8a5:T6DJrXAnHmgMJ+dOnFouta5

Score
10/10
blackmoonbankerdiscoverytrojanupx

Malware Config

Targets

    • Target

      e2047a9df925f44842bd69a434babfb5d3e358f09747d9debbede0a43e0f37b7N.exe

    • Size

      69KB

    • MD5

      ff6212c0a3a97ba292503b0527d6de20

    • SHA1

      592578884e585a4b46eb609061f6076525012f20

    • SHA256

      e2047a9df925f44842bd69a434babfb5d3e358f09747d9debbede0a43e0f37b7

    • SHA512

      241f06157be6a54461431840974d5e658ede0204ce65b919db996f01558a5400d892bae095e1321ce35dc0dc7e694be2aec48f3fe2f7e44a869b7e7d6267c093

    • SSDEEP

      1536:TPyr5BWPJgzJrQsA4MJ8SS5gq9a2pJ+jZOb4W9nouy8a5:T6DJrXAnHmgMJ+dOnFouta5

    Score
    10/10
    blackmoonbankerdiscoverytrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks