blackmoon | 5588ff784ba3a7cb1098ee43b264c1827f8dcdeb6112f7506020787a567ceb19

General

Target

5588ff784ba3a7cb1098ee43b264c1827f8dcdeb6112f7506020787a567ceb19N.exe
Size

366KB
Sample

241226-e5z7eaxkel
MD5

b2791d470ef60f08a129fcfc6c03d610
SHA1

1055e343bf6ec8daf26d8727401b99a39eeb0e37
SHA256

5588ff784ba3a7cb1098ee43b264c1827f8dcdeb6112f7506020787a567ceb19
SHA512

60ba9d5c7b248ddcd024a89fb22adbdf43bc3c96570323e8e20171475ce9b585bbbba70995cca2a41a37fd713ad6889d8194d0a08fd1ddb0c4db70bbda45a63b
SSDEEP

6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1t:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1t

Score

10^/10

Malware Config

Targets

- Target
  
  5588ff784ba3a7cb1098ee43b264c1827f8dcdeb6112f7506020787a567ceb19N.exe
- Size
  
  366KB
- MD5
  
  b2791d470ef60f08a129fcfc6c03d610
- SHA1
  
  1055e343bf6ec8daf26d8727401b99a39eeb0e37
- SHA256
  
  5588ff784ba3a7cb1098ee43b264c1827f8dcdeb6112f7506020787a567ceb19
- SHA512
  
  60ba9d5c7b248ddcd024a89fb22adbdf43bc3c96570323e8e20171475ce9b585bbbba70995cca2a41a37fd713ad6889d8194d0a08fd1ddb0c4db70bbda45a63b
- SSDEEP
  
  6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1t:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1t
Score

10^/10

blackmoon banker discovery trojan
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2