blackmoon | ca53fd3df37b262fde8f174e0efd2d4f57de6f0130e009748fcf669c3fae6461 | Triage

Submit
Reports

Overview

overview

Static

static

5

ca53fd3df3...61.exe

windows7-x64

ca53fd3df3...61.exe

windows10-2004-x64

Sharing

General

Target

ca53fd3df37b262fde8f174e0efd2d4f57de6f0130e009748fcf669c3fae6461
Size

69KB
Sample

241225-c8yfwavpet
MD5

6c5ef20154f58186bdf0917529d01b67
SHA1

1909dca5a05d243739dd01819fc6e16e9089b340
SHA256

ca53fd3df37b262fde8f174e0efd2d4f57de6f0130e009748fcf669c3fae6461
SHA512

6a25b372b99c108277faed251fd02c68405096b5b092862c7966082f6ec5df8165519b001053aeb4a82a6d81fcb3900749ba11c503455194926a49b617910aa1
SSDEEP

1536:TPyr5BWPJgzJrQsA4MJ8SS5gq9a2pJ+jZOb4W9nouy8a8:T6DJrXAnHmgMJ+dOnFouta8

Score

10^/10

blackmoon banker discovery trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

ca53fd3df37b262fde8f174e0efd2d4f57de6f0130e009748fcf669c3fae6461.exe

Resource

win7-20240903-en

blackmoon banker discovery trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

ca53fd3df37b262fde8f174e0efd2d4f57de6f0130e009748fcf669c3fae6461.exe

Resource

win10v2004-20241007-en

blackmoon banker discovery trojan upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  ca53fd3df37b262fde8f174e0efd2d4f57de6f0130e009748fcf669c3fae6461
- Size
  
  69KB
- MD5
  
  6c5ef20154f58186bdf0917529d01b67
- SHA1
  
  1909dca5a05d243739dd01819fc6e16e9089b340
- SHA256
  
  ca53fd3df37b262fde8f174e0efd2d4f57de6f0130e009748fcf669c3fae6461
- SHA512
  
  6a25b372b99c108277faed251fd02c68405096b5b092862c7966082f6ec5df8165519b001053aeb4a82a6d81fcb3900749ba11c503455194926a49b617910aa1
- SSDEEP
  
  1536:TPyr5BWPJgzJrQsA4MJ8SS5gq9a2pJ+jZOb4W9nouy8a8:T6DJrXAnHmgMJ+dOnFouta8
Score

10^/10

blackmoon banker discovery trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoverytrojanupx

behavioral2

blackmoonbankerdiscoverytrojanupx

© 2018-2024

Terms | Privacy