General

  • Target

    JaffaCakes118_b5ea1af38b1c7a905a1e7f374be3d4ffd6c5c3e6cc2d9f8cc3353eb507167c8d

  • Size

    1.2MB

  • Sample

    241224-mgjthsvmcs

  • MD5

    23385045a278db2211adf84cde24c791

  • SHA1

    99d112562f81b79a7645b2e6b9f128a19d5e1b03

  • SHA256

    b5ea1af38b1c7a905a1e7f374be3d4ffd6c5c3e6cc2d9f8cc3353eb507167c8d

  • SHA512

    9db4dcda18346bd0102be562b3d75ccb11f7291d1acee4ad00135dd254e7d5f6e733f50ec61b1335dd2e83a8230072cc457af7b5f3361b392fe82c0f76e423d0

  • SSDEEP

    24576:kB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:kBSDnV3XRfJ/emAUscMoCVuw

Malware Config

Targets

    • Target

      JaffaCakes118_b5ea1af38b1c7a905a1e7f374be3d4ffd6c5c3e6cc2d9f8cc3353eb507167c8d

    • Size

      1.2MB

    • MD5

      23385045a278db2211adf84cde24c791

    • SHA1

      99d112562f81b79a7645b2e6b9f128a19d5e1b03

    • SHA256

      b5ea1af38b1c7a905a1e7f374be3d4ffd6c5c3e6cc2d9f8cc3353eb507167c8d

    • SHA512

      9db4dcda18346bd0102be562b3d75ccb11f7291d1acee4ad00135dd254e7d5f6e733f50ec61b1335dd2e83a8230072cc457af7b5f3361b392fe82c0f76e423d0

    • SSDEEP

      24576:kB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:kBSDnV3XRfJ/emAUscMoCVuw

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks