blackmoon | f5598a684f0351b2eeaac55096c90f148cf7edbb582ef70fb820859c86d5a6cc | Triage

Submit
Reports

Overview

overview

Static

static

5

JaffaCakes...cc.exe

windows7-x64

JaffaCakes...cc.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_f5598a684f0351b2eeaac55096c90f148cf7edbb582ef70fb820859c86d5a6cc
Size

1.2MB
Sample

241223-1h43qsskfx
MD5

ca260ad7cfc77e11d0a93dbaf6b99b29
SHA1

babb4ff9c705c12f412332dc04a67b254d24f2b7
SHA256

f5598a684f0351b2eeaac55096c90f148cf7edbb582ef70fb820859c86d5a6cc
SHA512

aa72910a48385298d5688b0ad044bdc0b449bbfaafe3fa1f35c55565f913753ba3e96e604b0c92307bf700cdfe3afd07b928681eadc4d8f6cb69f40ef2caa7d5
SSDEEP

24576:IB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:IBSDnV3XRfJ/emAUscMoCVuw

Score

10^/10

blackmoon banker discovery persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_f5598a684f0351b2eeaac55096c90f148cf7edbb582ef70fb820859c86d5a6cc.exe

Resource

win7-20241023-en

blackmoon banker discovery persistence trojan upx

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_f5598a684f0351b2eeaac55096c90f148cf7edbb582ef70fb820859c86d5a6cc.exe

Resource

win10v2004-20241007-en

blackmoon banker discovery persistence trojan upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_f5598a684f0351b2eeaac55096c90f148cf7edbb582ef70fb820859c86d5a6cc
- Size
  
  1.2MB
- MD5
  
  ca260ad7cfc77e11d0a93dbaf6b99b29
- SHA1
  
  babb4ff9c705c12f412332dc04a67b254d24f2b7
- SHA256
  
  f5598a684f0351b2eeaac55096c90f148cf7edbb582ef70fb820859c86d5a6cc
- SHA512
  
  aa72910a48385298d5688b0ad044bdc0b449bbfaafe3fa1f35c55565f913753ba3e96e604b0c92307bf700cdfe3afd07b928681eadc4d8f6cb69f40ef2caa7d5
- SSDEEP
  
  24576:IB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:IBSDnV3XRfJ/emAUscMoCVuw
Score

10^/10

blackmoon banker discovery persistence trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Server Software Component: Terminal Services DLL
  persistence
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoverypersistencetrojanupx

behavioral2

blackmoonbankerdiscoverypersistencetrojanupx

© 2018-2024

Terms | Privacy