General

  • Target

    2025-07-04_46f6a21cab3a62f24c170aa51f213e2f_amadey_elex_icedid_rhadamanthys_smoke-loader_stop_tofsee_xiaobaminer

  • Size

    4.0MB

  • Sample

    250704-n2d97sstex

  • MD5

    46f6a21cab3a62f24c170aa51f213e2f

  • SHA1

    4b20d5d29ea4336aefb9c7f02cefaf6090cad4ca

  • SHA256

    254ef9b002331a585bee4975b38fea201b965f8503574759158470f9dc31403e

  • SHA512

    8dcf65cb3a76a92a52094a47a87e2f08d93712c0f0cdce79d842206bf5f94d27cc78f3e16eee4f5b5e82b3125aa5326a90314cfd5baa61cbd0fff14f68891970

  • SSDEEP

    49152:9bYwIkppisrPa0PdWbYwIkppisrPa0Pd8h76TKEph7GBfWeWoGODTPhFIunIu6yN:yciK9ciKB77GBfWeLRIuitk

Malware Config

Targets

    • Target

      2025-07-04_46f6a21cab3a62f24c170aa51f213e2f_amadey_elex_icedid_rhadamanthys_smoke-loader_stop_tofsee_xiaobaminer

    • Size

      4.0MB

    • MD5

      46f6a21cab3a62f24c170aa51f213e2f

    • SHA1

      4b20d5d29ea4336aefb9c7f02cefaf6090cad4ca

    • SHA256

      254ef9b002331a585bee4975b38fea201b965f8503574759158470f9dc31403e

    • SHA512

      8dcf65cb3a76a92a52094a47a87e2f08d93712c0f0cdce79d842206bf5f94d27cc78f3e16eee4f5b5e82b3125aa5326a90314cfd5baa61cbd0fff14f68891970

    • SSDEEP

      49152:9bYwIkppisrPa0PdWbYwIkppisrPa0Pd8h76TKEph7GBfWeWoGODTPhFIunIu6yN:yciK9ciKB77GBfWeLRIuitk

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks