blackmoon | 88da6de4a752151dbb2936855e1307f628628bfc0597bec39ce61b7347b7d3ba | Triage

Submit
Reports

Overview

overview

Static

static

5

88da6de4a7...ba.exe

windows7-x64

88da6de4a7...ba.exe

windows10-2004-x64

Sharing

General

Target

88da6de4a752151dbb2936855e1307f628628bfc0597bec39ce61b7347b7d3ba
Size

11.3MB
Sample

241221-fams9ssqdx
MD5

700608d1bfe2c81db02cbdde080252bd
SHA1

4fc0ce37f41622ce450a06054f827385bdbf14c9
SHA256

88da6de4a752151dbb2936855e1307f628628bfc0597bec39ce61b7347b7d3ba
SHA512

696bf5df4fcebe086f4373403ad83a78fcdce72277d6aa1943966683991cd707f7cacc6aea6d7d49b7d37fa51ce6b7d5f71b79fba4aaccbd514728ffa44018d1
SSDEEP

196608:gvScToVXQcM66VGe1SOg4ZH6uzE40Q4LR0ra8xo6ToZXtS1rYks21Dje/GS:w9uQcv6UhOg4F9ZgKhxfOXt3UDqeS

Score

10^/10

blackmoon banker discovery phishing trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

88da6de4a752151dbb2936855e1307f628628bfc0597bec39ce61b7347b7d3ba.exe

Resource

win7-20240903-en

blackmoon banker discovery phishing trojan upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

88da6de4a752151dbb2936855e1307f628628bfc0597bec39ce61b7347b7d3ba.exe

Resource

win10v2004-20241007-en

blackmoon banker discovery trojan upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  88da6de4a752151dbb2936855e1307f628628bfc0597bec39ce61b7347b7d3ba
- Size
  
  11.3MB
- MD5
  
  700608d1bfe2c81db02cbdde080252bd
- SHA1
  
  4fc0ce37f41622ce450a06054f827385bdbf14c9
- SHA256
  
  88da6de4a752151dbb2936855e1307f628628bfc0597bec39ce61b7347b7d3ba
- SHA512
  
  696bf5df4fcebe086f4373403ad83a78fcdce72277d6aa1943966683991cd707f7cacc6aea6d7d49b7d37fa51ce6b7d5f71b79fba4aaccbd514728ffa44018d1
- SSDEEP
  
  196608:gvScToVXQcM66VGe1SOg4ZH6uzE40Q4LR0ra8xo6ToZXtS1rYks21Dje/GS:w9uQcv6UhOg4F9ZgKhxfOXt3UDqeS
Score

10^/10

blackmoon banker discovery phishing trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- A potential corporate email address has been identified in the URL: png@3x
  phishing
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoveryphishingtrojanupx

behavioral2

blackmoonbankerdiscoverytrojanupx

© 2018-2024

Terms | Privacy