Overview

overview

10

Static

static

7

31e96cb3a3...3b.exe

windows7-x64

10

31e96cb3a3...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    31e96cb3a3221248a5366e77dd7875881d87a1fa8e1d600e7391e4b29c7a143b

  • Size

    74KB

  • Sample

    241228-hmk7baxjbn

  • MD5

    b7271bf228819caeb7bfe8cabd5c2144

  • SHA1

    638bd82882c9a1c7b4a87887bd8422cbabc7b165

  • SHA256

    31e96cb3a3221248a5366e77dd7875881d87a1fa8e1d600e7391e4b29c7a143b

  • SHA512

    05f22cf747c31b16fde1223e4dba607d6e00af27cdc77d56ff1da3c10d6c4c99e711c7e7e6f312d79c69be3a90d3fc97a9582a9df0b60b8e2b488ec784b67c38

  • SSDEEP

    1536:01ZFv0c58/n70fFQQxaAGLiVIzNhXDr8oQD0+SAvkSXYcClG6DR9hCoQZuj5oLr:0FvhqPeLeeqzNhXfnQA+BJczzCoQZq5D

Score
10/10
blackmoonfatalrataspackv2bankerdiscoveryinfostealerrattrojanvmprotect

Malware Config

Targets

    • Target

      31e96cb3a3221248a5366e77dd7875881d87a1fa8e1d600e7391e4b29c7a143b

    • Size

      74KB

    • MD5

      b7271bf228819caeb7bfe8cabd5c2144

    • SHA1

      638bd82882c9a1c7b4a87887bd8422cbabc7b165

    • SHA256

      31e96cb3a3221248a5366e77dd7875881d87a1fa8e1d600e7391e4b29c7a143b

    • SHA512

      05f22cf747c31b16fde1223e4dba607d6e00af27cdc77d56ff1da3c10d6c4c99e711c7e7e6f312d79c69be3a90d3fc97a9582a9df0b60b8e2b488ec784b67c38

    • SSDEEP

      1536:01ZFv0c58/n70fFQQxaAGLiVIzNhXDr8oQD0+SAvkSXYcClG6DR9hCoQZuj5oLr:0FvhqPeLeeqzNhXfnQA+BJczzCoQZq5D

    Score
    10/10
    blackmoonfatalratbankerdiscoveryinfostealerrattrojanvmprotect

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatalrat family

      fatalrat

    • Fatal Rat payload

      ratinfostealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks