blackmoon | a03d0f95fc769d2d3e3e657fdfb69b9b02413e6459ffb676fe86dc0678e934cc | Triage

Submit
Reports

Overview

overview

Static

static

a03d0f95fc...cN.exe

windows7-x64

a03d0f95fc...cN.exe

windows10-2004-x64

Sharing

General

Target

a03d0f95fc769d2d3e3e657fdfb69b9b02413e6459ffb676fe86dc0678e934ccN.exe
Size

1.8MB
Sample

241126-a62dmsvpaz
MD5

10a99d00159dcd34d509a3f1014d20d0
SHA1

af060b8c9712beb1f9be5d326ea80751a0ff52d7
SHA256

a03d0f95fc769d2d3e3e657fdfb69b9b02413e6459ffb676fe86dc0678e934cc
SHA512

975e4814453c9f616618e41a424c27f378b9ebb94cc34afd2c27655c061eb2d6032f39796777da28655f7fd7fb560cedc862d4065a79488b754c2556c7a483e4
SSDEEP

12288:fqGKl6bcNQSjEgkSiP8Lr2mFE66kjlKuJ9J7tfg+LRZq01Y:fNKl6b8JYgyP8WTGIuhZvPq

Score

10^/10

blackmoon banker defense_evasion discovery trojan upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

a03d0f95fc769d2d3e3e657fdfb69b9b02413e6459ffb676fe86dc0678e934ccN.exe

Resource

win7-20240903-en

blackmoon banker defense_evasion discovery trojan upx

windows7-x64

19 signatures

120 seconds

Behavioral task

behavioral2

Sample

a03d0f95fc769d2d3e3e657fdfb69b9b02413e6459ffb676fe86dc0678e934ccN.exe

Resource

win10v2004-20241007-en

blackmoon banker defense_evasion discovery trojan upx

windows10-2004-x64

18 signatures

120 seconds

Malware Config

Targets

- Target
  
  a03d0f95fc769d2d3e3e657fdfb69b9b02413e6459ffb676fe86dc0678e934ccN.exe
- Size
  
  1.8MB
- MD5
  
  10a99d00159dcd34d509a3f1014d20d0
- SHA1
  
  af060b8c9712beb1f9be5d326ea80751a0ff52d7
- SHA256
  
  a03d0f95fc769d2d3e3e657fdfb69b9b02413e6459ffb676fe86dc0678e934cc
- SHA512
  
  975e4814453c9f616618e41a424c27f378b9ebb94cc34afd2c27655c061eb2d6032f39796777da28655f7fd7fb560cedc862d4065a79488b754c2556c7a483e4
- SSDEEP
  
  12288:fqGKl6bcNQSjEgkSiP8Lr2mFE66kjlKuJ9J7tfg+LRZq01Y:fNKl6b8JYgyP8WTGIuhZvPq
Score

10^/10

blackmoon banker defense_evasion discovery trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

Clear Persistence

Credential Access

Discovery

Remote System Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdefense_evasiondiscoverytrojanupx

behavioral2

blackmoonbankerdefense_evasiondiscoverytrojanupx

© 2018-2024

Terms | Privacy