General

  • Target

    JaffaCakes118_bb8faa205c0fb765b58faf711c4b44a15db35428707aa5543918eb29e79e98cc

  • Size

    1.2MB

  • Sample

    241224-wnvn2atjfz

  • MD5

    a4f2b0e06546885764f1e2dcdddef882

  • SHA1

    1320f58ac5d1a3e4414469dff8c57f9a20692a59

  • SHA256

    bb8faa205c0fb765b58faf711c4b44a15db35428707aa5543918eb29e79e98cc

  • SHA512

    8471c988830b0cc002971a2abcdafa7ea3c093cf67dbd411c6a562814dfd0469976373bdc4807f6bfdf3b62a2aec8b74e7a81dd961e4f39a0b093ac244678c32

  • SSDEEP

    24576:eB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:eBSDnV3XRfJ/emAUscMoCVuw

Malware Config

Targets

    • Target

      JaffaCakes118_bb8faa205c0fb765b58faf711c4b44a15db35428707aa5543918eb29e79e98cc

    • Size

      1.2MB

    • MD5

      a4f2b0e06546885764f1e2dcdddef882

    • SHA1

      1320f58ac5d1a3e4414469dff8c57f9a20692a59

    • SHA256

      bb8faa205c0fb765b58faf711c4b44a15db35428707aa5543918eb29e79e98cc

    • SHA512

      8471c988830b0cc002971a2abcdafa7ea3c093cf67dbd411c6a562814dfd0469976373bdc4807f6bfdf3b62a2aec8b74e7a81dd961e4f39a0b093ac244678c32

    • SSDEEP

      24576:eB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:eBSDnV3XRfJ/emAUscMoCVuw

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks