General

  • Target

    JaffaCakes118_b73e4be6d541b905a621964bf9362484fbef4f9531731031277825517137815e

  • Size

    1.2MB

  • Sample

    241225-htchra1kdq

  • MD5

    f71a93350b9c2b923f406ef34a2ad67e

  • SHA1

    29839f8de34811d2621bd3243c582ad98646bc24

  • SHA256

    b73e4be6d541b905a621964bf9362484fbef4f9531731031277825517137815e

  • SHA512

    5041374429c3b31705c257741c45a6754dfc3e6305f8a92feb27f52d7134c6e5c05e7941b6b103bd0f8539c8aea525b02450d081967418369738b278aeed9b99

  • SSDEEP

    24576:BB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:BBSDnV3XRfJ/emAUscMoCVuw

Malware Config

Targets

    • Target

      JaffaCakes118_b73e4be6d541b905a621964bf9362484fbef4f9531731031277825517137815e

    • Size

      1.2MB

    • MD5

      f71a93350b9c2b923f406ef34a2ad67e

    • SHA1

      29839f8de34811d2621bd3243c582ad98646bc24

    • SHA256

      b73e4be6d541b905a621964bf9362484fbef4f9531731031277825517137815e

    • SHA512

      5041374429c3b31705c257741c45a6754dfc3e6305f8a92feb27f52d7134c6e5c05e7941b6b103bd0f8539c8aea525b02450d081967418369738b278aeed9b99

    • SSDEEP

      24576:BB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:BBSDnV3XRfJ/emAUscMoCVuw

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks