Overview

overview

10

Static

static

7

4e10ba8614...da.exe

windows7-x64

10

4e10ba8614...da.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da

  • Size

    74KB

  • Sample

    241229-s42whatraw

  • MD5

    46d85a24ab5d5435e1ac054fd9514d9e

  • SHA1

    1d81c7986bc5f47078e50b2f41668eb16ec2bb15

  • SHA256

    4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da

  • SHA512

    951660395cee249aca77953c34d4af015ab8bb0ba0a7ccfc15f4a6033dfb0b182d667988da0c16e4a9af0744deaa6b64e5f07a7ab6aa47f1ed948ccbe512a35d

  • SSDEEP

    1536:Ow3g1JoEokN7SdJUsl9Uy90kEdms6DR9hCoQZuj5oLrWLL:r3gPodk1SdJUIR9RKmtzCoQZq5og

Score
10/10
blackmoonfatalrataspackv2bankerdiscoveryinfostealerrattrojanvmprotect

Malware Config

Targets

    • Target

      4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da

    • Size

      74KB

    • MD5

      46d85a24ab5d5435e1ac054fd9514d9e

    • SHA1

      1d81c7986bc5f47078e50b2f41668eb16ec2bb15

    • SHA256

      4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da

    • SHA512

      951660395cee249aca77953c34d4af015ab8bb0ba0a7ccfc15f4a6033dfb0b182d667988da0c16e4a9af0744deaa6b64e5f07a7ab6aa47f1ed948ccbe512a35d

    • SSDEEP

      1536:Ow3g1JoEokN7SdJUsl9Uy90kEdms6DR9hCoQZuj5oLrWLL:r3gPodk1SdJUIR9RKmtzCoQZq5og

    Score
    10/10
    blackmoonfatalratbankerdiscoveryinfostealerrattrojanvmprotect

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatalrat family

      fatalrat

    • Fatal Rat payload

      ratinfostealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks