Overview

overview

10

Static

static

3

d36d96120d...e0.exe

windows7-x64

10

d36d96120d...e0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0

  • Size

    107KB

  • Sample

    241218-shzh9asrdx

  • MD5

    e919228dc7dad297ff3b11ba33e6bf63

  • SHA1

    ae82ec491c80521d8d74bc11d26d3dfe103e8c3f

  • SHA256

    d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0

  • SHA512

    d712412c63a808ac6623d8988fac4a29f6fc87b1bd0ae784494654146847dc2a6fd6b57907f2f798c6de42698c1304e65b2fe836a294d74435c0732dbe89dcce

  • SSDEEP

    1536:nnTCqOpUwDWHpuFFedUSERPfZnmQJYR3iVeO64MDYewM6CbEjZV5MRigHR3S20Z8:TwUw88FeMVmgYR3VO64MEew9rHml3Y

Score
10/10
blackmoonfatalratbankerdiscoveryinfostealerrattrojanvmprotect

Malware Config

Targets

    • Target

      d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0

    • Size

      107KB

    • MD5

      e919228dc7dad297ff3b11ba33e6bf63

    • SHA1

      ae82ec491c80521d8d74bc11d26d3dfe103e8c3f

    • SHA256

      d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0

    • SHA512

      d712412c63a808ac6623d8988fac4a29f6fc87b1bd0ae784494654146847dc2a6fd6b57907f2f798c6de42698c1304e65b2fe836a294d74435c0732dbe89dcce

    • SSDEEP

      1536:nnTCqOpUwDWHpuFFedUSERPfZnmQJYR3iVeO64MDYewM6CbEjZV5MRigHR3S20Z8:TwUw88FeMVmgYR3VO64MEew9rHml3Y

    Score
    10/10
    blackmoonfatalratbankerdiscoveryinfostealerrattrojanvmprotect

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatalrat family

      fatalrat

    • Fatal Rat payload

      ratinfostealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks