General

  • Target

    JaffaCakes118_97224e4ed5ccbc52e732c92e98252bb5684dff7405f1ce9bcacc16f157aab253

  • Size

    1.2MB

  • Sample

    241223-pxsgpsznan

  • MD5

    77f8847d13e91c566705810a1989b9a9

  • SHA1

    1a3c67d2303273636a6135e9496835176d4a42c0

  • SHA256

    97224e4ed5ccbc52e732c92e98252bb5684dff7405f1ce9bcacc16f157aab253

  • SHA512

    17fd9ce1658f082e2a9ca594941187c24e6b58f72d4ac209f3e99e885df5872d211a2a84c53d85bde63fc5c834ee79dbed60bc7ddee295e2dc9b21e60de4544a

  • SSDEEP

    24576:3B0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:3BSDnV3XRfJ/emAUscMoCVuw

Malware Config

Targets

    • Target

      JaffaCakes118_97224e4ed5ccbc52e732c92e98252bb5684dff7405f1ce9bcacc16f157aab253

    • Size

      1.2MB

    • MD5

      77f8847d13e91c566705810a1989b9a9

    • SHA1

      1a3c67d2303273636a6135e9496835176d4a42c0

    • SHA256

      97224e4ed5ccbc52e732c92e98252bb5684dff7405f1ce9bcacc16f157aab253

    • SHA512

      17fd9ce1658f082e2a9ca594941187c24e6b58f72d4ac209f3e99e885df5872d211a2a84c53d85bde63fc5c834ee79dbed60bc7ddee295e2dc9b21e60de4544a

    • SSDEEP

      24576:3B0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:3BSDnV3XRfJ/emAUscMoCVuw

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks