blackmoon | 1a80aba5a880b774185fac18eb226102f8157210fffec1a99a3ec603dea1b170

General

Target

1a80aba5a880b774185fac18eb226102f8157210fffec1a99a3ec603dea1b170.exe
Size

337KB
Sample

250217-cbacsawlgs
MD5

e9b7c7c189db4e0f5a75c22ab8a3f1c0
SHA1

f7b021977257d1fa5c625cbb340f66ea3f78e877
SHA256

1a80aba5a880b774185fac18eb226102f8157210fffec1a99a3ec603dea1b170
SHA512

770273b9dab1886b31bf974d32daa7bd91efd3327ac4e88e60f5807a107d59657c884dfa78af2eaa59778a9dc11a94b540c739695c3702fc2746a997d79b31fb
SSDEEP

6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRA:R4wFHoSHYHUrAwfMp3CDRA

Score

10^/10

Malware Config

Targets

- Target
  
  1a80aba5a880b774185fac18eb226102f8157210fffec1a99a3ec603dea1b170.exe
- Size
  
  337KB
- MD5
  
  e9b7c7c189db4e0f5a75c22ab8a3f1c0
- SHA1
  
  f7b021977257d1fa5c625cbb340f66ea3f78e877
- SHA256
  
  1a80aba5a880b774185fac18eb226102f8157210fffec1a99a3ec603dea1b170
- SHA512
  
  770273b9dab1886b31bf974d32daa7bd91efd3327ac4e88e60f5807a107d59657c884dfa78af2eaa59778a9dc11a94b540c739695c3702fc2746a997d79b31fb
- SSDEEP
  
  6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRA:R4wFHoSHYHUrAwfMp3CDRA
Score

10^/10

blackmoon banker discovery trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2