Analysis
-
max time kernel
93s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 14:11
General
-
Target
采集/DY评论采集.exe
-
Size
180KB
-
MD5
1726eddc5659441e0b564bd4fdb971c9
-
SHA1
282948743d0df2211dedd894cecede76b15a58f7
-
SHA256
f402e390cd1ffd25923337fbaaf26f23014dabeffddd76a0112ffd534d44698b
-
SHA512
ddb7994909949d38cec447b0813150b3767573a341f94c5bb9f6faa211e2ac99b7be5bc6339745229e512e9b34e67d221def932f77610b87b2519db4c4f56aa6
-
SSDEEP
3072:HMt2hXu9HoKZoSUPPxyRiz5PHkz2dLlCN+leNFgOv0JB3fDe0V80i6k2:gj9HBUxvI2dLlCQlkDvo7G0i6
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\采集\DY评论采集.exe"C:\Users\Admin\AppData\Local\Temp\采集\DY评论采集.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
348KB
-
Filesize
348KB