Overview

overview

10

Static

static

7

5e9f4b22e7...af.exe

windows7-x64

10

5e9f4b22e7...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e9f4b22e76abdbe8a6cc94c2d28e50856cc70119d48a8088950b09d0d20e3af

  • Size

    224KB

  • Sample

    250104-hfgkjszjcn

  • MD5

    0acf5ea827fc57eda9e472ce32a1afce

  • SHA1

    2b588fdf93ffaf670872eab8471bbe8a0db8e166

  • SHA256

    5e9f4b22e76abdbe8a6cc94c2d28e50856cc70119d48a8088950b09d0d20e3af

  • SHA512

    16de65df2600800126175a8d127eb3b8dd338a307113f4f3d78e6157d355a36eebd32d68167d42d9c574d02ba0b7f3d5590933df6bc01968c0328f0ee157b184

  • SSDEEP

    3072:kVlnyXTKQPzhfX22FlM2vLLsfHJqRu8stppm0G3dzhrOCIMgZMElGY5jIbhgAfJE:aljQtlM2zLEkeO0GttrOR1MEcYlJj

Score
10/10
blackmoonfatalrataspackv2bankerdiscoveryinfostealerrattrojanvmprotect

Malware Config

Targets

    • Target

      5e9f4b22e76abdbe8a6cc94c2d28e50856cc70119d48a8088950b09d0d20e3af

    • Size

      224KB

    • MD5

      0acf5ea827fc57eda9e472ce32a1afce

    • SHA1

      2b588fdf93ffaf670872eab8471bbe8a0db8e166

    • SHA256

      5e9f4b22e76abdbe8a6cc94c2d28e50856cc70119d48a8088950b09d0d20e3af

    • SHA512

      16de65df2600800126175a8d127eb3b8dd338a307113f4f3d78e6157d355a36eebd32d68167d42d9c574d02ba0b7f3d5590933df6bc01968c0328f0ee157b184

    • SSDEEP

      3072:kVlnyXTKQPzhfX22FlM2vLLsfHJqRu8stppm0G3dzhrOCIMgZMElGY5jIbhgAfJE:aljQtlM2zLEkeO0GttrOR1MEcYlJj

    Score
    10/10
    blackmoonfatalratbankerdiscoveryinfostealerrattrojanvmprotect

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatalrat family

      fatalrat

    • Fatal Rat payload

      ratinfostealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks