blackmoon | b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468

General

Target

b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468
Size

15.0MB
Sample

250218-hv64raykb1
MD5

38c64fa7d7d7478732b04c42b71afa3a
SHA1

8534bed0e1694a090c7ff9b8f010bcff02bccd3e
SHA256

b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468
SHA512

7079d628c25edb62886eab75a8fe5fec096a584bbdabf68ffba810ea0b9913a9c2e6f2366acc9ccd8859a42cb4768febdc422d23043d4252f4b97d2475aadefb
SSDEEP

196608:iQwfQzHzARHblaR6cnawftA3YTcd1Oc5h2dxDbElK:AQTzuoRbBfQYT042YdBkK

Score

10^/10

Malware Config

Targets

- Target
  
  b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468
- Size
  
  15.0MB
- MD5
  
  38c64fa7d7d7478732b04c42b71afa3a
- SHA1
  
  8534bed0e1694a090c7ff9b8f010bcff02bccd3e
- SHA256
  
  b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468
- SHA512
  
  7079d628c25edb62886eab75a8fe5fec096a584bbdabf68ffba810ea0b9913a9c2e6f2366acc9ccd8859a42cb4768febdc422d23043d4252f4b97d2475aadefb
- SSDEEP
  
  196608:iQwfQzHzARHblaR6cnawftA3YTcd1Oc5h2dxDbElK:AQTzuoRbBfQYT042YdBkK
Score

10^/10

blackmoon gh0strat banker defense_evasion discovery persistence privilege_escalation rat trojan upx
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Server Software Component: Terminal Services DLL
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2