Overview

overview

10

Static

static

10

2025-04-22...er.exe

windows10-2004-x64

10

2025-04-22...er.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-22_70d9a6b536a493fd7d595a0528cb45a0_amadey_cloudeye_elex_hacktools_mimikatz_rhadamanthys_smoke-loader

  • Size

    11.5MB

  • Sample

    250422-c42yha1zaw

  • MD5

    70d9a6b536a493fd7d595a0528cb45a0

  • SHA1

    916464e96c1bd20dc2c313191bda72bcf98931c8

  • SHA256

    acac7cc22d5f44bb386a48dd023c61e294012fee1ac8655403f093106e414685

  • SHA512

    2ef2e9db626182018983aef0cb4308f35c4497b6784621c6c13099acc1fff0875b4b54b8b942e0c30a12710a54a6c0c5229f3af76ffc5a2c5109fc191858d764

  • SSDEEP

    196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH

Score
10/10
blackmoonmimikatzbankerdiscoverytrojanupx

Malware Config

Targets

    • Target

      2025-04-22_70d9a6b536a493fd7d595a0528cb45a0_amadey_cloudeye_elex_hacktools_mimikatz_rhadamanthys_smoke-loader

    • Size

      11.5MB

    • MD5

      70d9a6b536a493fd7d595a0528cb45a0

    • SHA1

      916464e96c1bd20dc2c313191bda72bcf98931c8

    • SHA256

      acac7cc22d5f44bb386a48dd023c61e294012fee1ac8655403f093106e414685

    • SHA512

      2ef2e9db626182018983aef0cb4308f35c4497b6784621c6c13099acc1fff0875b4b54b8b942e0c30a12710a54a6c0c5229f3af76ffc5a2c5109fc191858d764

    • SSDEEP

      196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH

    Score
    10/10
    blackmoonmimikatzbankerdiscoverytrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks