Overview

overview

10

Static

static

7

4db7f1e2af...8b.exe

windows7-x64

10

4db7f1e2af...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4db7f1e2af1b45bb553367e0d647412d98e0c96f279741d659c917332b4f0a8b.zip

  • Size

    292KB

  • Sample

    241218-ezskdatrgr

  • MD5

    b0512575eb2842e3a41cb71ce1abfc13

  • SHA1

    749183ded69c0c21ce18ad7b4b6cf35e5ead9b78

  • SHA256

    12dc6befbe3141175c53a1a7101da1c2c331f1d327a4db6f516cdf7377ab9864

  • SHA512

    e0adb1a5cc5eb8a772e4bf59fa82591c4a8d5e902ee1ff3fda3c0d2a4591515ee2581da6bfefc33bb39860d313d91b3b910e367a506ee51aa8d2022f508e6b4b

  • SSDEEP

    6144:fqNxokvXeAIHNs6cCJhRlo5oVQY6G0urOqMu04knRUvMQ9suTwO:fqNdeAIts9uhfyG1rAu04kRU0QKMb

Score
10/10
blackmoonbankerdiscoverytrojanvmprotect

Malware Config

Targets

    • Target

      4db7f1e2af1b45bb553367e0d647412d98e0c96f279741d659c917332b4f0a8b

    • Size

      313KB

    • MD5

      eaf5345059f113339739a7ffd4699493

    • SHA1

      18fac611d92252312492a58ea6b8a97bd417f5b4

    • SHA256

      4db7f1e2af1b45bb553367e0d647412d98e0c96f279741d659c917332b4f0a8b

    • SHA512

      0d0a040996e096cd904915ab6e58e9d166a8a246397b6c2011eec2b2a81c78003bd65d74069069be4fdeedf8b0702a6da255808a0a55c3c9cfc032934c2144fd

    • SSDEEP

      6144:0OHIa9D10DMZxS1rsyqlzG/cOwT/LSHTQmO7TZMkrn1IcfJW3Ft:ToaoDCx+4yYnSuqkDjRW3F

    Score
    10/10
    blackmoonbankerdiscoverytrojanvmprotect

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks