blackmoon | 2a03d87477d5c0a2f84538779b4b6c860067fc0276fe8a810807d8177931bd1f

General

Target

2a03d87477d5c0a2f84538779b4b6c860067fc0276fe8a810807d8177931bd1fN.exe
Size

86KB
Sample

241126-bepq7swkbv
MD5

49786adf48758c538b278c55bed45a40
SHA1

b8c2fdae1b543ee444de88e97fc9ef6b0b9183f5
SHA256

2a03d87477d5c0a2f84538779b4b6c860067fc0276fe8a810807d8177931bd1f
SHA512

41fa7b18ac05838ea7a7a2885eafadaa09c7087e83fb151479332cb4cbcbeed692706bcb4983389c2b5b4a3d745d15dc5a1dddb877e5ffbe1439d77b8cc7a101
SSDEEP

1536:/s2OpUqBA6pkuTHQ0cIrf+7LYsF03RYSYhM9l8yDI15XygDdDv:/ImRWTTpc627LXFm6+9l8nygDdD

Score

10^/10

Malware Config

Targets

- Target
  
  2a03d87477d5c0a2f84538779b4b6c860067fc0276fe8a810807d8177931bd1fN.exe
- Size
  
  86KB
- MD5
  
  49786adf48758c538b278c55bed45a40
- SHA1
  
  b8c2fdae1b543ee444de88e97fc9ef6b0b9183f5
- SHA256
  
  2a03d87477d5c0a2f84538779b4b6c860067fc0276fe8a810807d8177931bd1f
- SHA512
  
  41fa7b18ac05838ea7a7a2885eafadaa09c7087e83fb151479332cb4cbcbeed692706bcb4983389c2b5b4a3d745d15dc5a1dddb877e5ffbe1439d77b8cc7a101
- SSDEEP
  
  1536:/s2OpUqBA6pkuTHQ0cIrf+7LYsF03RYSYhM9l8yDI15XygDdDv:/ImRWTTpc627LXFm6+9l8nygDdD
Score

10^/10

blackmoon banker discovery trojan
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2