blackmoon | 97da3b940784391248a269926d7a1fc1115f403133f77de2750623e6f7bfc330

General

Target

97da3b940784391248a269926d7a1fc1115f403133f77de2750623e6f7bfc330
Size

159KB
Sample

250309-ganagaxzbz
MD5

00b7985b67ce3103a463b27a088db1bd
SHA1

8443f0bfc9be9e92e9500fcb3d09fa87aac411e1
SHA256

97da3b940784391248a269926d7a1fc1115f403133f77de2750623e6f7bfc330
SHA512

8b550bf2c5230fb7afad02e716848c8203739ea2d166f4ff89559a0e1cd776faab0459d628fa52c7c4fb8762a25b408c87a94e9879d04f5d1a3f393368dac1c2
SSDEEP

3072:pDPoADAuj34+sqbSFEmjfv2JxhGtBxUYBN46:psAbj3yEmjfvIxhGtBy4N46

Score

10^/10

Malware Config

Targets

- Target
  
  97da3b940784391248a269926d7a1fc1115f403133f77de2750623e6f7bfc330
- Size
  
  159KB
- MD5
  
  00b7985b67ce3103a463b27a088db1bd
- SHA1
  
  8443f0bfc9be9e92e9500fcb3d09fa87aac411e1
- SHA256
  
  97da3b940784391248a269926d7a1fc1115f403133f77de2750623e6f7bfc330
- SHA512
  
  8b550bf2c5230fb7afad02e716848c8203739ea2d166f4ff89559a0e1cd776faab0459d628fa52c7c4fb8762a25b408c87a94e9879d04f5d1a3f393368dac1c2
- SSDEEP
  
  3072:pDPoADAuj34+sqbSFEmjfv2JxhGtBxUYBN46:psAbj3yEmjfvIxhGtBy4N46
Score

10^/10

blackmoon gh0strat banker discovery rat trojan upx defense_evasion persistence privilege_escalation
- Blackmoon family
  blackmoon
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Server Software Component: Terminal Services DLL
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2