Overview

overview

10

Static

static

10

cf330001c6...98.exe

windows7-x64

10

cf330001c6...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf330001c6a368743c040ca4b4ab14ba91e183f9a5e307e328c9fa530f3bf798

  • Size

    2.8MB

  • Sample

    241228-djllfsvpfl

  • MD5

    4cbc5893310449f6df889572f6d89527

  • SHA1

    a7234e1b4915f1557cc6b2f82e4ec7fe1eaf69b0

  • SHA256

    cf330001c6a368743c040ca4b4ab14ba91e183f9a5e307e328c9fa530f3bf798

  • SHA512

    22a2d012566b0dce9d8cb4d71f41159a35dca52f5d3be046f057ec4a78af47fd25fe906375b1b7d62a1514b9ee340911cb8a4791619640ca2a9381d4903b31cb

  • SSDEEP

    49152:oF+P9VgqrzbfDULyOPtjN/lXekpomFsEB7yOrRBST1Wjy9:++PfRELyOhN/lXe4FsNyOWW9

Score
10/10
blackmoonbankerdiscoverypersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      cf330001c6a368743c040ca4b4ab14ba91e183f9a5e307e328c9fa530f3bf798

    • Size

      2.8MB

    • MD5

      4cbc5893310449f6df889572f6d89527

    • SHA1

      a7234e1b4915f1557cc6b2f82e4ec7fe1eaf69b0

    • SHA256

      cf330001c6a368743c040ca4b4ab14ba91e183f9a5e307e328c9fa530f3bf798

    • SHA512

      22a2d012566b0dce9d8cb4d71f41159a35dca52f5d3be046f057ec4a78af47fd25fe906375b1b7d62a1514b9ee340911cb8a4791619640ca2a9381d4903b31cb

    • SSDEEP

      49152:oF+P9VgqrzbfDULyOPtjN/lXekpomFsEB7yOrRBST1Wjy9:++PfRELyOhN/lXe4FsNyOWW9

    Score
    10/10
    blackmoonbankerdiscoverypersistenceprivilege_escalationtrojan

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks