Overview

overview

10

Static

static

3

JaffaCakes...68.exe

windows10-2004-x64

10

JaffaCakes...68.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ca5b08f9fd5693eb4126738d68d6ac68

  • Size

    34KB

  • Sample

    250421-w5wmna1xhw

  • MD5

    ca5b08f9fd5693eb4126738d68d6ac68

  • SHA1

    a81e3488ad3cbb3232cfeada9cb8f5fafcd62078

  • SHA256

    33a238742a161d7c292f77a097a9992c912bfd547b60963df9312bd827937d46

  • SHA512

    09e2b7941651a39fbede3fada199df5a0a12b973ec84aa3c8f0fa97de36194ac893dc8c1579ab64fb5d694f0cd3cf628e3f6109f41318c83c68a21225f66ce17

  • SSDEEP

    768:Sxa4PfkczEClQF0QGqwq0E6Na8WFaDrTCMNR8Gx8IPE7BNKSzHctMli:bQftW0QGq/aabWrTsGx3P6Cbtr

Score
10/10
blackmoonbankerdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_ca5b08f9fd5693eb4126738d68d6ac68

    • Size

      34KB

    • MD5

      ca5b08f9fd5693eb4126738d68d6ac68

    • SHA1

      a81e3488ad3cbb3232cfeada9cb8f5fafcd62078

    • SHA256

      33a238742a161d7c292f77a097a9992c912bfd547b60963df9312bd827937d46

    • SHA512

      09e2b7941651a39fbede3fada199df5a0a12b973ec84aa3c8f0fa97de36194ac893dc8c1579ab64fb5d694f0cd3cf628e3f6109f41318c83c68a21225f66ce17

    • SSDEEP

      768:Sxa4PfkczEClQF0QGqwq0E6Na8WFaDrTCMNR8Gx8IPE7BNKSzHctMli:bQftW0QGq/aabWrTsGx3P6Cbtr

    Score
    10/10
    blackmoonbankerdiscoverypersistencetrojan

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks