Overview

overview

10

Static

static

3

JaffaCakes...75.exe

windows10-2004-x64

10

JaffaCakes...75.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ccc14f94eccf3f722d49c668490b3075

  • Size

    135KB

  • Sample

    250422-glpmnsv1gx

  • MD5

    ccc14f94eccf3f722d49c668490b3075

  • SHA1

    3a5c5f492693560e5ce944eb72c8686eb9a39a34

  • SHA256

    32cb3af974ccb3dc8d388295ecfe21b012282d1e8864cdef9461167fc451a89d

  • SHA512

    d79db53e3f13fa9ddf56c30720d7704a2f666ee65c1bc99eb79d9e5dbf2e7e83d7cc49ca3a1db0b79474fe7a0c9d933a7005dce43f71b757ee965c7be69cd514

  • SSDEEP

    3072:tK09Db3ZwZfUvcELArb5dSUDWXgnUy+PUOU2ge4fGu9V3+ws:tnp34GA/SUsHU2g1GgV3S

Score
10/10
blackmoonbankerdefense_evasiondiscoverypersistencetrojanvmprotect

Malware Config

Targets

    • Target

      JaffaCakes118_ccc14f94eccf3f722d49c668490b3075

    • Size

      135KB

    • MD5

      ccc14f94eccf3f722d49c668490b3075

    • SHA1

      3a5c5f492693560e5ce944eb72c8686eb9a39a34

    • SHA256

      32cb3af974ccb3dc8d388295ecfe21b012282d1e8864cdef9461167fc451a89d

    • SHA512

      d79db53e3f13fa9ddf56c30720d7704a2f666ee65c1bc99eb79d9e5dbf2e7e83d7cc49ca3a1db0b79474fe7a0c9d933a7005dce43f71b757ee965c7be69cd514

    • SSDEEP

      3072:tK09Db3ZwZfUvcELArb5dSUDWXgnUy+PUOU2ge4fGu9V3+ws:tnp34GA/SUsHU2g1GgV3S

    Score
    10/10
    blackmoonbankerdefense_evasiondiscoverypersistencetrojanvmprotect

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks