blackmoon | ab32e389f4b93a0dec5f463b6f6e71b0e32c76955fe781bd9331617fd8241182 | Triage

Submit
Reports

Overview

overview

Static

static

7

ab32e389f4...82.dll

windows7-x64

ab32e389f4...82.dll

windows10-2004-x64

Sharing

General

Target

ab32e389f4b93a0dec5f463b6f6e71b0e32c76955fe781bd9331617fd8241182
Size

464KB
Sample

241226-tb7fyszjdy
MD5

9195e367c752a833e0522863bd7206b8
SHA1

f4dc3a9637c94a1e9ed83fbdb34fe5d02986a011
SHA256

ab32e389f4b93a0dec5f463b6f6e71b0e32c76955fe781bd9331617fd8241182
SHA512

8954376fe204754a93427b6ad5f67174b89eaba950f9c0288a75ee6ac8b4c05c21a2a065fffe5a4382f64a3047f88bb6650a60159ccbfb2a553a9cdce870efd6
SSDEEP

12288:P9Ctm7WMaYDjuvwCcYPvIXHPKL1JyUScnoBR2:P917WMEzcY3IXiZJy2oB0

Score

10^/10

blackmoon banker discovery trojan vmprotect

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

ab32e389f4b93a0dec5f463b6f6e71b0e32c76955fe781bd9331617fd8241182.dll

Resource

win7-20240708-en

blackmoon banker discovery trojan vmprotect

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

ab32e389f4b93a0dec5f463b6f6e71b0e32c76955fe781bd9331617fd8241182.dll

Resource

win10v2004-20241007-en

blackmoon banker discovery trojan vmprotect

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  ab32e389f4b93a0dec5f463b6f6e71b0e32c76955fe781bd9331617fd8241182
- Size
  
  464KB
- MD5
  
  9195e367c752a833e0522863bd7206b8
- SHA1
  
  f4dc3a9637c94a1e9ed83fbdb34fe5d02986a011
- SHA256
  
  ab32e389f4b93a0dec5f463b6f6e71b0e32c76955fe781bd9331617fd8241182
- SHA512
  
  8954376fe204754a93427b6ad5f67174b89eaba950f9c0288a75ee6ac8b4c05c21a2a065fffe5a4382f64a3047f88bb6650a60159ccbfb2a553a9cdce870efd6
- SSDEEP
  
  12288:P9Ctm7WMaYDjuvwCcYPvIXHPKL1JyUScnoBR2:P917WMEzcY3IXiZJy2oB0
Score

10^/10

blackmoon banker discovery trojan vmprotect
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackmoonbankerdiscoverytrojanvmprotect

behavioral2

blackmoonbankerdiscoverytrojanvmprotect

© 2018-2025

Terms | Privacy