Overview

overview

10

Static

static

1

2024-12-21...id.exe

windows7-x64

10

2024-12-21...id.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-21_0cf078084380fed6fd4442e48b2c444c_icedid

  • Size

    1.1MB

  • Sample

    241221-bswrnszjbr

  • MD5

    0cf078084380fed6fd4442e48b2c444c

  • SHA1

    b495baad7740ade6c58ee1a64e40432a23aa0c94

  • SHA256

    ebc62243a0a801c9966c98befa5f0a30ffaea13f30a3f705911373ac0d71b410

  • SHA512

    3093261a01f796fd7dbcaf9895fa0e6cc6379ce3e5488f98e6c547ba38c46a9fa86dffe81cc357e0a19c3096bf1b88350027aac7bb509856b299296ef2930c9a

  • SSDEEP

    12288:lDxjQa1iQWYkWDMZA/95zeFSqsarFossFFy2f/r2AgERqwa6mi/qION7MwQ3LkvB:lDpQa1iLYpDx/Hz01sFQSz2AghjaZ3QZ

Score
10/10
blackmoonbankerdiscoveryevasiontrojanupx

Malware Config

Targets

    • Target

      2024-12-21_0cf078084380fed6fd4442e48b2c444c_icedid

    • Size

      1.1MB

    • MD5

      0cf078084380fed6fd4442e48b2c444c

    • SHA1

      b495baad7740ade6c58ee1a64e40432a23aa0c94

    • SHA256

      ebc62243a0a801c9966c98befa5f0a30ffaea13f30a3f705911373ac0d71b410

    • SHA512

      3093261a01f796fd7dbcaf9895fa0e6cc6379ce3e5488f98e6c547ba38c46a9fa86dffe81cc357e0a19c3096bf1b88350027aac7bb509856b299296ef2930c9a

    • SSDEEP

      12288:lDxjQa1iQWYkWDMZA/95zeFSqsarFossFFy2f/r2AgERqwa6mi/qION7MwQ3LkvB:lDpQa1iLYpDx/Hz01sFQSz2AghjaZ3QZ

    Score
    10/10
    blackmoonbankerdiscoveryevasiontrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UAC bypass

      evasiontrojan

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks