blackmoon | 5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0

General

Target

5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0.exe
Size

80KB
Sample

241217-k3pksawkcv
MD5

bac35ee7440228dda7daee46a835adb0
SHA1

12ede66acfa70fd90dbebf6c6490b5ff5acac4d3
SHA256

5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0
SHA512

25c2b80198940e8b5002a1b3308338a9b56090c56a610982a3299fecfa7af23f030c68a6dfa8769b2924ecf7d047dfb92a6953534a943ea45af5b9148e4b44a1
SSDEEP

1536:ITJxjZZ29Up2U7O0Ov15+o46zqMi9G7WXnQQvaWh3zWKfx/t126a63m:SHZ2up5JkH+o46LuRXnLdpzp/tg6Z3m

Score

10^/10

Malware Config

Targets

- Target
  
  5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0.exe
- Size
  
  80KB
- MD5
  
  bac35ee7440228dda7daee46a835adb0
- SHA1
  
  12ede66acfa70fd90dbebf6c6490b5ff5acac4d3
- SHA256
  
  5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0
- SHA512
  
  25c2b80198940e8b5002a1b3308338a9b56090c56a610982a3299fecfa7af23f030c68a6dfa8769b2924ecf7d047dfb92a6953534a943ea45af5b9148e4b44a1
- SSDEEP
  
  1536:ITJxjZZ29Up2U7O0Ov15+o46zqMi9G7WXnQQvaWh3zWKfx/t126a63m:SHZ2up5JkH+o46LuRXnLdpzp/tg6Z3m
Score

10^/10

blackmoon banker discovery trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2