General

  • Target

    JaffaCakes118_dbc768eeda7131fada7f892400121216e54591dda6d4658324e06cdad0843ebe

  • Size

    1.2MB

  • Sample

    241223-3m3rksvnew

  • MD5

    54190c34f1a76d1510c2776b56143b6e

  • SHA1

    c330aac5156f897d493d944d158d9d9d62cdc4a5

  • SHA256

    dbc768eeda7131fada7f892400121216e54591dda6d4658324e06cdad0843ebe

  • SHA512

    ef7b09e1f5c419379df335558feee4add734af55ea327a3229b4549c148ff5d606088bda91900988b5ad10b5ec5737cd264011ca0cd1acba59108b3ed8030fa5

  • SSDEEP

    24576:aB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:aBSDnV3XRfJ/emAUscMoCVuw

Malware Config

Targets

    • Target

      JaffaCakes118_dbc768eeda7131fada7f892400121216e54591dda6d4658324e06cdad0843ebe

    • Size

      1.2MB

    • MD5

      54190c34f1a76d1510c2776b56143b6e

    • SHA1

      c330aac5156f897d493d944d158d9d9d62cdc4a5

    • SHA256

      dbc768eeda7131fada7f892400121216e54591dda6d4658324e06cdad0843ebe

    • SHA512

      ef7b09e1f5c419379df335558feee4add734af55ea327a3229b4549c148ff5d606088bda91900988b5ad10b5ec5737cd264011ca0cd1acba59108b3ed8030fa5

    • SSDEEP

      24576:aB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:aBSDnV3XRfJ/emAUscMoCVuw

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks