Overview

overview

10

Static

static

5

a129edb245...59.exe

windows7-x64

10

a129edb245...59.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a129edb2459b68f371e2590eaa38878d3b134bda2c19f06e427a79a44625d659

  • Size

    271KB

  • Sample

    241225-mt4dpasldq

  • MD5

    b65af95dd327d8069899bc47a37d899f

  • SHA1

    290f70a8c564d33d5c2960dd96faa270f72600ec

  • SHA256

    a129edb2459b68f371e2590eaa38878d3b134bda2c19f06e427a79a44625d659

  • SHA512

    690c1bf284bb48e93e9e83b8af8988299b11cbf4e6b38dbfe87ab5e8775b82379529a630d9a5c69a9c2d954e0047cbe35c34903ef75f0fffda7483c9a8d4857e

  • SSDEEP

    6144:uWXALnQgAnQiys9q5pP8VKfl3hQTS2vCd8Rc2Cnc8L7hb:1GSnQ/N5J8VKdmTIdDbncS7hb

Score
10/10
blackmoonbankerdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      a129edb2459b68f371e2590eaa38878d3b134bda2c19f06e427a79a44625d659

    • Size

      271KB

    • MD5

      b65af95dd327d8069899bc47a37d899f

    • SHA1

      290f70a8c564d33d5c2960dd96faa270f72600ec

    • SHA256

      a129edb2459b68f371e2590eaa38878d3b134bda2c19f06e427a79a44625d659

    • SHA512

      690c1bf284bb48e93e9e83b8af8988299b11cbf4e6b38dbfe87ab5e8775b82379529a630d9a5c69a9c2d954e0047cbe35c34903ef75f0fffda7483c9a8d4857e

    • SSDEEP

      6144:uWXALnQgAnQiys9q5pP8VKfl3hQTS2vCd8Rc2Cnc8L7hb:1GSnQ/N5J8VKdmTIdDbncS7hb

    Score
    10/10
    blackmoonbankerdiscoveryevasionpersistencetrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UAC bypass

      evasiontrojan

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks