General

  • Target

    2b447d28c69e52dc9a89d3096c94c11842146f7520dc7005b43a9775f413be93

  • Size

    336KB

  • Sample

    250127-zl42gavrgp

  • MD5

    2075cc6fdebb6b4b3589f544142edd4e

  • SHA1

    cd37364be0fd946ccc6719a588caab9b16b4c2c2

  • SHA256

    2b447d28c69e52dc9a89d3096c94c11842146f7520dc7005b43a9775f413be93

  • SHA512

    48f538bd0a655c8ec72cbfcace82e5c3db9f9b0a3715e671a3f48fd4dcb09b675b2bcc34e698c66748851ecd0c990e8d7e6fa24aed2dc8b0639bf1dc00f7adbe

  • SSDEEP

    6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeeE:R4wFHoSHYHUrAwfMp3CDeE

Malware Config

Targets

    • Target

      2b447d28c69e52dc9a89d3096c94c11842146f7520dc7005b43a9775f413be93

    • Size

      336KB

    • MD5

      2075cc6fdebb6b4b3589f544142edd4e

    • SHA1

      cd37364be0fd946ccc6719a588caab9b16b4c2c2

    • SHA256

      2b447d28c69e52dc9a89d3096c94c11842146f7520dc7005b43a9775f413be93

    • SHA512

      48f538bd0a655c8ec72cbfcace82e5c3db9f9b0a3715e671a3f48fd4dcb09b675b2bcc34e698c66748851ecd0c990e8d7e6fa24aed2dc8b0639bf1dc00f7adbe

    • SSDEEP

      6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeeE:R4wFHoSHYHUrAwfMp3CDeE

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks