General

  • Target

    JaffaCakes118_d2fc0ae3aebcc0c64140edc4d4e3756c75ecee844da7104443265e421df34c40

  • Size

    1.2MB

  • Sample

    241223-wp1axawrdq

  • MD5

    937d2685d82146af3790b70f9c521320

  • SHA1

    697f8ba35b1aa2cd4c30813eccf55013d3b7f568

  • SHA256

    d2fc0ae3aebcc0c64140edc4d4e3756c75ecee844da7104443265e421df34c40

  • SHA512

    869b23cd9ff1f0183425b452ce55f35dc3f712c0d36dc22ceeb134bc64ba62884f95d65ff0d860f729f70ccf58972a83997a1a9c2640c67b822029de1c5b4835

  • SSDEEP

    24576:1B0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:1BSDnV3XRfJ/emAUscMoCVuw

Malware Config

Targets

    • Target

      JaffaCakes118_d2fc0ae3aebcc0c64140edc4d4e3756c75ecee844da7104443265e421df34c40

    • Size

      1.2MB

    • MD5

      937d2685d82146af3790b70f9c521320

    • SHA1

      697f8ba35b1aa2cd4c30813eccf55013d3b7f568

    • SHA256

      d2fc0ae3aebcc0c64140edc4d4e3756c75ecee844da7104443265e421df34c40

    • SHA512

      869b23cd9ff1f0183425b452ce55f35dc3f712c0d36dc22ceeb134bc64ba62884f95d65ff0d860f729f70ccf58972a83997a1a9c2640c67b822029de1c5b4835

    • SSDEEP

      24576:1B0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:1BSDnV3XRfJ/emAUscMoCVuw

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks