Extracted

• • Target

    c688aae516ace671f7fa824fdec8bd707c372ca848940bc1892395f8ebbedb93

  • Size

    2.5MB

  • MD5

    642a17854f3d6bfba19c14fe37d4330e

  • SHA1

    3bfefe6bf91fe3743b64ca4fe643bf8c347e83c5

  • SHA256

    c688aae516ace671f7fa824fdec8bd707c372ca848940bc1892395f8ebbedb93

  • SHA512

    d1b9bcd7f187763e308db2a18222bab10acd070afbe766d6231c2d34cf78e7716d0666a8dc1d986e74f8d93bdd6ede205fb472917de1398f8763adcb78a89db9

  • SSDEEP

    49152:S+ggKOb+Hqoo3gU9DPjOP+9Rq1S78JgxVJ9y9EvpoWoGODTPnAlm26TKY5:Dg2KK3z9OP+9Rqc7zJy9QoLalc

  Score

  10^/10

  blackmoongozixmrigbankerdiscoveryevasionisfbminerpersistencespywarestealertrojanupx

  • Blackmoon family

    blackmoon

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • UAC bypass

    evasiontrojan

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2