blackmoon | a33fc45d3d24272746694f8909362b9c74bc9df19c9ce7007376433f4c750957

General

Target

e80c543aab145c327b76588109aa28d1_JaffaCakes118
Size

221KB
Sample

241212-ysr5tawkes
MD5

e80c543aab145c327b76588109aa28d1
SHA1

a35a5c8a80ab7fd7daf9df9cc653f6793cacbef9
SHA256

a33fc45d3d24272746694f8909362b9c74bc9df19c9ce7007376433f4c750957
SHA512

982aabe3302ce51752ec1903818d7097c5e056ae8ef64056f4e9f3ac1de8395d147616828baef8db98752eab348165c1fe1db24a12992ff5ff5b5b08c35e466d
SSDEEP

3072:GL0C1vc5IjJ0305245nqQMh9rfjWSEYGIBSKSwyY4fgIKFHPcoutK1vH1UFG0:iHqaqkEKGXrfqOqwyY+noSKXUL

Score

10^/10

Malware Config

Targets

- Target
  
  e80c543aab145c327b76588109aa28d1_JaffaCakes118
- Size
  
  221KB
- MD5
  
  e80c543aab145c327b76588109aa28d1
- SHA1
  
  a35a5c8a80ab7fd7daf9df9cc653f6793cacbef9
- SHA256
  
  a33fc45d3d24272746694f8909362b9c74bc9df19c9ce7007376433f4c750957
- SHA512
  
  982aabe3302ce51752ec1903818d7097c5e056ae8ef64056f4e9f3ac1de8395d147616828baef8db98752eab348165c1fe1db24a12992ff5ff5b5b08c35e466d
- SSDEEP
  
  3072:GL0C1vc5IjJ0305245nqQMh9rfjWSEYGIBSKSwyY4fgIKFHPcoutK1vH1UFG0:iHqaqkEKGXrfqOqwyY+noSKXUL
Score

10^/10

blackmoon modiloader banker discovery trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

ModiLoader, DBatLoader

Modiloader family

ModiLoader Second Stage

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2