blackmoon | 2ae9d000e2f249254aa56456b40cba7cea109deaa97bc8da5115e428c4c02f5f

General

Target

2ae9d000e2f249254aa56456b40cba7cea109deaa97bc8da5115e428c4c02f5f
Size

6.6MB
Sample

241203-vrypesvmdx
MD5

178f8ae20d793c3a2cc25ef7715fc835
SHA1

6c8a40beef75cd0c5db29fe4546bd963b28ad0c3
SHA256

2ae9d000e2f249254aa56456b40cba7cea109deaa97bc8da5115e428c4c02f5f
SHA512

dfb77599c41869d1479cfa41ca6696bcc95e4535f1d9ecce3a5bd328343129d49786083d772502b1a4d4fe1b5fd1b78a81cba8f72c7bfa671110103e0144837d
SSDEEP

98304:hws2ANnKXOaeOgmhxD4skDP1dOcdbuMM0pg8XRTEOh7U226m56ZcNXZ:zKXbeO7PDUOSuMXe8BTr5JctNJ

Score

10^/10

Malware Config

Targets

- Target
  
  2ae9d000e2f249254aa56456b40cba7cea109deaa97bc8da5115e428c4c02f5f
- Size
  
  6.6MB
- MD5
  
  178f8ae20d793c3a2cc25ef7715fc835
- SHA1
  
  6c8a40beef75cd0c5db29fe4546bd963b28ad0c3
- SHA256
  
  2ae9d000e2f249254aa56456b40cba7cea109deaa97bc8da5115e428c4c02f5f
- SHA512
  
  dfb77599c41869d1479cfa41ca6696bcc95e4535f1d9ecce3a5bd328343129d49786083d772502b1a4d4fe1b5fd1b78a81cba8f72c7bfa671110103e0144837d
- SSDEEP
  
  98304:hws2ANnKXOaeOgmhxD4skDP1dOcdbuMM0pg8XRTEOh7U226m56ZcNXZ:zKXbeO7PDUOSuMXe8BTr5JctNJ
Score

10^/10

blackmoon gh0strat purplefox banker discovery persistence rat rootkit trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Purplefox family
  purplefox
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2