blackmoon | 78039aab990bf932170e0ef08a73923948d7c93389a61fc5fd1f5ee5ca78398a

General

Target

78039aab990bf932170e0ef08a73923948d7c93389a61fc5fd1f5ee5ca78398a.exe
Size

366KB
Sample

241217-exv8gs1pan
MD5

d38fe2c1df43af863869a2ef1583691e
SHA1

fb90b302b1664840560b2920955f2eff4bccd50c
SHA256

78039aab990bf932170e0ef08a73923948d7c93389a61fc5fd1f5ee5ca78398a
SHA512

19ff4a33ba4648607bdbc5362ed55603b15248bf6fa7491c968c9fbe12fe3b9819d45cb39eaf46db640d8ffa1e29f24f37ad2fe753e509ace63cb21bd372cf59
SSDEEP

6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1m:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1m

Score

10^/10

Malware Config

Targets

- Target
  
  78039aab990bf932170e0ef08a73923948d7c93389a61fc5fd1f5ee5ca78398a.exe
- Size
  
  366KB
- MD5
  
  d38fe2c1df43af863869a2ef1583691e
- SHA1
  
  fb90b302b1664840560b2920955f2eff4bccd50c
- SHA256
  
  78039aab990bf932170e0ef08a73923948d7c93389a61fc5fd1f5ee5ca78398a
- SHA512
  
  19ff4a33ba4648607bdbc5362ed55603b15248bf6fa7491c968c9fbe12fe3b9819d45cb39eaf46db640d8ffa1e29f24f37ad2fe753e509ace63cb21bd372cf59
- SSDEEP
  
  6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1m:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1m
Score

10^/10

blackmoon banker discovery trojan
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2