blackmoon | ef79533e643bb11424280d23b8270999c52cc226f409f72e972073f1adad7d2d | Triage

Submit
Reports

Overview

overview

Static

static

ef79533e64...2d.exe

windows7-x64

ef79533e64...2d.exe

windows10-2004-x64

Sharing

General

Target

ef79533e643bb11424280d23b8270999c52cc226f409f72e972073f1adad7d2d
Size

314KB
Sample

241225-vdcvsszjhn
MD5

afee45b830be9fae35ebda722b801800
SHA1

2b49f9ed6ae2b0c36612d2267b58803bab96259e
SHA256

ef79533e643bb11424280d23b8270999c52cc226f409f72e972073f1adad7d2d
SHA512

d485dff2f4eda2c140e2ee87f3d048c3b78157c82ab746ca1704dcd7c38f67e98b42b6f31137ae6ef84a4c35b3cbe9d012977b62a7a2cd52ee80adfda5597862
SSDEEP

6144:PMivKqmiRqbQFI7tjBty1xYtwQYpk0iYCF+lq9177tGKBoudDeklV04E3:0kYbQFI7RPwk00rFekHLE

Score

10^/10

blackmoon banker discovery persistence trojan upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

ef79533e643bb11424280d23b8270999c52cc226f409f72e972073f1adad7d2d.exe

Resource

win7-20240903-en

blackmoon banker discovery persistence trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

ef79533e643bb11424280d23b8270999c52cc226f409f72e972073f1adad7d2d.exe

Resource

win10v2004-20241007-en

blackmoon banker discovery persistence trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  ef79533e643bb11424280d23b8270999c52cc226f409f72e972073f1adad7d2d
- Size
  
  314KB
- MD5
  
  afee45b830be9fae35ebda722b801800
- SHA1
  
  2b49f9ed6ae2b0c36612d2267b58803bab96259e
- SHA256
  
  ef79533e643bb11424280d23b8270999c52cc226f409f72e972073f1adad7d2d
- SHA512
  
  d485dff2f4eda2c140e2ee87f3d048c3b78157c82ab746ca1704dcd7c38f67e98b42b6f31137ae6ef84a4c35b3cbe9d012977b62a7a2cd52ee80adfda5597862
- SSDEEP
  
  6144:PMivKqmiRqbQFI7tjBty1xYtwQYpk0iYCF+lq9177tGKBoudDeklV04E3:0kYbQFI7RPwk00rFekHLE
Score

10^/10

blackmoon banker discovery persistence trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Modifies RDP port number used by Windows
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Remote Services

Remote Desktop Protocol

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoverypersistencetrojanupx

behavioral2

blackmoonbankerdiscoverypersistencetrojanupx

© 2018-2024

Terms | Privacy