blackmoon | 4492433d53cefa40630f1e69e4d9faec8a3c6e053d5238f4dbf15c80f6174b3a

General

Target

4492433d53cefa40630f1e69e4d9faec8a3c6e053d5238f4dbf15c80f6174b3a
Size

165KB
Sample

241217-kn59zswpak
MD5

b4e9e9c30e8bcbd772c5514eae67eb4e
SHA1

e10cc914137ca1309ab8d6ae9aa1969f6b9fe997
SHA256

4492433d53cefa40630f1e69e4d9faec8a3c6e053d5238f4dbf15c80f6174b3a
SHA512

6c1dd11263615fcf60f82e9251191eec30cc482854115baa5e126ed14b2efce8ff2c6fe58d77c41a016453a6fc94ea79a80fec1905aea35b3a0e9ec4863ad833
SSDEEP

3072:pDPoADAuj34+sqbSFEmjfv2JxhGtBxUYBN46:psAbj3yEmjfvIxhGtBy4N46

Score

10^/10

Malware Config

Targets

- Target
  
  4492433d53cefa40630f1e69e4d9faec8a3c6e053d5238f4dbf15c80f6174b3a
- Size
  
  165KB
- MD5
  
  b4e9e9c30e8bcbd772c5514eae67eb4e
- SHA1
  
  e10cc914137ca1309ab8d6ae9aa1969f6b9fe997
- SHA256
  
  4492433d53cefa40630f1e69e4d9faec8a3c6e053d5238f4dbf15c80f6174b3a
- SHA512
  
  6c1dd11263615fcf60f82e9251191eec30cc482854115baa5e126ed14b2efce8ff2c6fe58d77c41a016453a6fc94ea79a80fec1905aea35b3a0e9ec4863ad833
- SSDEEP
  
  3072:pDPoADAuj34+sqbSFEmjfv2JxhGtBxUYBN46:psAbj3yEmjfvIxhGtBy4N46
Score

10^/10

blackmoon gh0strat banker discovery evasion persistence privilege_escalation rat trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Server Software Component: Terminal Services DLL
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2