Overview

overview

10

Static

static

10

58073c2455...0e.exe

windows7-x64

10

58073c2455...0e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58073c2455e4ddc230a68309ecb830991596572ce76afc715b229c75ed37a10e.exe

  • Size

    408KB

  • Sample

    241218-dlwt7s1ral

  • MD5

    1d9e4bc56c15d5a5e4c8649a1c5dbf19

  • SHA1

    d49a7dccc32e95b83bf8e32261c305e67a82f668

  • SHA256

    58073c2455e4ddc230a68309ecb830991596572ce76afc715b229c75ed37a10e

  • SHA512

    9ca27f6eb510f51fe58ba6bbb74ed44a057841bed1a21af1e2b993686029c1b17f15a38616c38fd63871c34aba25afcff11ee77167ad0ec863c9a5617e8834fd

  • SSDEEP

    6144:K5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zIydenCG:K5/Q58drihGiLhmGNiZsx0B/zIkenCG

Score
10/10
blackmoonbankerdiscoverytrojanupx

Malware Config

Targets

    • Target

      58073c2455e4ddc230a68309ecb830991596572ce76afc715b229c75ed37a10e.exe

    • Size

      408KB

    • MD5

      1d9e4bc56c15d5a5e4c8649a1c5dbf19

    • SHA1

      d49a7dccc32e95b83bf8e32261c305e67a82f668

    • SHA256

      58073c2455e4ddc230a68309ecb830991596572ce76afc715b229c75ed37a10e

    • SHA512

      9ca27f6eb510f51fe58ba6bbb74ed44a057841bed1a21af1e2b993686029c1b17f15a38616c38fd63871c34aba25afcff11ee77167ad0ec863c9a5617e8834fd

    • SSDEEP

      6144:K5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zIydenCG:K5/Q58drihGiLhmGNiZsx0B/zIkenCG

    Score
    10/10
    blackmoonbankerdiscoverytrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks