Overview

overview

10

Static

static

7

2419c90550...4e.exe

windows7-x64

10

2419c90550...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e

  • Size

    246KB

  • Sample

    241231-gfjjgazres

  • MD5

    0886ff81f6c22255df038271f0ce3ef8

  • SHA1

    c689bfa64579811e4eed0c0517b64cce16451259

  • SHA256

    2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e

  • SHA512

    b4d75df3b25a82748479f959e66cc8d27efaf0b9abfe1fed398b37cd7e74232ea907bb22c8d7d29bb37debf65901f40530c1be1f5a32220a4f9334697d527798

  • SSDEEP

    3072:2AUpC6wm9ITYGZ8HED96BKb4QDzTPJc5XLMedtjKZlfED9yETXZTSU98ohblrAFD:2Hg61yTt+TKpLBctLMhbcrD9zxAFhG

Score
10/10
blackmoonfatalrataspackv2bankerdiscoveryinfostealerrattrojanvmprotect

Malware Config

Targets

    • Target

      2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e

    • Size

      246KB

    • MD5

      0886ff81f6c22255df038271f0ce3ef8

    • SHA1

      c689bfa64579811e4eed0c0517b64cce16451259

    • SHA256

      2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e

    • SHA512

      b4d75df3b25a82748479f959e66cc8d27efaf0b9abfe1fed398b37cd7e74232ea907bb22c8d7d29bb37debf65901f40530c1be1f5a32220a4f9334697d527798

    • SSDEEP

      3072:2AUpC6wm9ITYGZ8HED96BKb4QDzTPJc5XLMedtjKZlfED9yETXZTSU98ohblrAFD:2Hg61yTt+TKpLBctLMhbcrD9zxAFhG

    Score
    10/10
    blackmoonfatalratbankerdiscoveryinfostealerrattrojanvmprotect

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatalrat family

      fatalrat

    • Fatal Rat payload

      ratinfostealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks