blackmoon | fb0914093b967639a4935a70c9130a12fa469098b5d28f7d1dee9feb1c166b47 | Triage

Submit
Reports

Overview

overview

Static

static

fb0914093b...47.exe

windows7-x64

fb0914093b...47.exe

windows10-2004-x64

Sharing

General

Target

fb0914093b967639a4935a70c9130a12fa469098b5d28f7d1dee9feb1c166b47
Size

1.8MB
Sample

241219-xxmv8axpa1
MD5

11ddb98b97d1a9aaf69085b5961eca69
SHA1

2375082d7f97b5b6088a32e4197a0a0dd97286bc
SHA256

fb0914093b967639a4935a70c9130a12fa469098b5d28f7d1dee9feb1c166b47
SHA512

50219b63433f3da06f6f1896c8aa65f196130deb773c31b5bc40706dc402eeadc546c3012f7535324dabd4164ea2f649b1c6674dc5eb2652b5b40648c63fba09
SSDEEP

24576:HfqMeY3QBhoWYJgIDWAeTkzZ+RkFN/yKBUZZAFDrrqBh3SWgSklWXKBUZd:HneXoWS5ZRN/yKiZEDrKBST1WXKiZd

Score

10^/10

blackmoon banker discovery persistence privilege_escalation trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

fb0914093b967639a4935a70c9130a12fa469098b5d28f7d1dee9feb1c166b47.exe

Resource

win7-20241010-en

blackmoon banker discovery persistence privilege_escalation trojan

windows7-x64

11 signatures

60 seconds

Behavioral task

behavioral2

Sample

fb0914093b967639a4935a70c9130a12fa469098b5d28f7d1dee9feb1c166b47.exe

Resource

win10v2004-20241007-en

blackmoon banker discovery persistence privilege_escalation trojan

windows10-2004-x64

12 signatures

60 seconds

Malware Config

Targets

- Target
  
  fb0914093b967639a4935a70c9130a12fa469098b5d28f7d1dee9feb1c166b47
- Size
  
  1.8MB
- MD5
  
  11ddb98b97d1a9aaf69085b5961eca69
- SHA1
  
  2375082d7f97b5b6088a32e4197a0a0dd97286bc
- SHA256
  
  fb0914093b967639a4935a70c9130a12fa469098b5d28f7d1dee9feb1c166b47
- SHA512
  
  50219b63433f3da06f6f1896c8aa65f196130deb773c31b5bc40706dc402eeadc546c3012f7535324dabd4164ea2f649b1c6674dc5eb2652b5b40648c63fba09
- SSDEEP
  
  24576:HfqMeY3QBhoWYJgIDWAeTkzZ+RkFN/yKBUZZAFDrrqBh3SWgSklWXKBUZd:HneXoWS5ZRN/yKiZEDrKBST1WXKiZd
Score

10^/10

blackmoon banker discovery persistence privilege_escalation trojan
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoverypersistenceprivilege_escalationtrojan

behavioral2

blackmoonbankerdiscoverypersistenceprivilege_escalationtrojan

© 2018-2025

Terms | Privacy