Overview

overview

10

Static

static

7

33cf43751b...c2.exe

windows7-x64

10

33cf43751b...c2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    33cf43751b8ccc1776b7fc0c3f8a96cf7924d9b020ce7d5ac4d62cabc14637c2

  • Size

    107KB

  • Sample

    241211-dnn75sxrdk

  • MD5

    4eb4cf8d874a83cd3b36972c7419d817

  • SHA1

    719f9d537a32280c0203b80f54ce0c5083343226

  • SHA256

    33cf43751b8ccc1776b7fc0c3f8a96cf7924d9b020ce7d5ac4d62cabc14637c2

  • SHA512

    4e0704ee6fe9700efde7728d56b6727b5ff599555c795233a0d8cbcc546dceb4223b25b7f4c558386995fc2a55e17dcfe43bd7b34a622f98c77e1fdd208908a2

  • SSDEEP

    1536:qnTCqOpUwDWHpuFFedUSERPfZnmQJYR3iVeO64MDYewM6CbEjZV5MRigHR3S20Z8:0wUw88FeMVmgYR3VO64MEew9rHml3Y

Score
10/10
blackmoonfatalrataspackv2bankerdiscoveryinfostealerrattrojanvmprotect

Malware Config

Targets

    • Target

      33cf43751b8ccc1776b7fc0c3f8a96cf7924d9b020ce7d5ac4d62cabc14637c2

    • Size

      107KB

    • MD5

      4eb4cf8d874a83cd3b36972c7419d817

    • SHA1

      719f9d537a32280c0203b80f54ce0c5083343226

    • SHA256

      33cf43751b8ccc1776b7fc0c3f8a96cf7924d9b020ce7d5ac4d62cabc14637c2

    • SHA512

      4e0704ee6fe9700efde7728d56b6727b5ff599555c795233a0d8cbcc546dceb4223b25b7f4c558386995fc2a55e17dcfe43bd7b34a622f98c77e1fdd208908a2

    • SSDEEP

      1536:qnTCqOpUwDWHpuFFedUSERPfZnmQJYR3iVeO64MDYewM6CbEjZV5MRigHR3S20Z8:0wUw88FeMVmgYR3VO64MEew9rHml3Y

    Score
    10/10
    blackmoonfatalratbankerdiscoveryinfostealerrattrojanvmprotect

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatalrat family

      fatalrat

    • Fatal Rat payload

      ratinfostealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks