General

  • Target

    JaffaCakes118_cd1d880b5e8e176170a0da9a7ca1866048f848716073276fe3251939b7513ea5

  • Size

    1.2MB

  • Sample

    241223-1e7pfssjht

  • MD5

    d24b34d45f5094191af39702ec60e8fa

  • SHA1

    23d8c92e02eaae309c63f21d7265487c25a46adc

  • SHA256

    cd1d880b5e8e176170a0da9a7ca1866048f848716073276fe3251939b7513ea5

  • SHA512

    9c959bacb26c900651fce77f805ef9800074a0b0692efaf824c2e5805a8916443c1fce18c972d1624a4bb1d2e3ab15b3f171209c3119ae1ce9212412782942f3

  • SSDEEP

    24576:HB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:HBSDnV3XRfJ/emAUscMoCVuw

Malware Config

Targets

    • Target

      JaffaCakes118_cd1d880b5e8e176170a0da9a7ca1866048f848716073276fe3251939b7513ea5

    • Size

      1.2MB

    • MD5

      d24b34d45f5094191af39702ec60e8fa

    • SHA1

      23d8c92e02eaae309c63f21d7265487c25a46adc

    • SHA256

      cd1d880b5e8e176170a0da9a7ca1866048f848716073276fe3251939b7513ea5

    • SHA512

      9c959bacb26c900651fce77f805ef9800074a0b0692efaf824c2e5805a8916443c1fce18c972d1624a4bb1d2e3ab15b3f171209c3119ae1ce9212412782942f3

    • SSDEEP

      24576:HB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:HBSDnV3XRfJ/emAUscMoCVuw

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks