General

  • Target

    2025-07-04_0aa68a786697ce67af0b5e754035b1d8_black-basta_elex_hijackloader_icedid_rhadamanthys_xiaobaminer

  • Size

    3.0MB

  • Sample

    250704-pq86wasye1

  • MD5

    0aa68a786697ce67af0b5e754035b1d8

  • SHA1

    77082891f5aa78ef9581a9796cc7e897bdba05d9

  • SHA256

    27da37fd272632e4fa10be797d57d6916916d45183f420bdf88233d1fe70a633

  • SHA512

    6f079aaa940339906cd6a6ed8a825c5e4d91caa4092cb59e182ea044a422b8aeb6fae28ab6bed71b2f17f7a41cb97a3023dae901611165380a6bcee2c36e1452

  • SSDEEP

    49152:9bYwnzcErdA6TKxrua0vOnmx9dgjI45TMwwapIgTI:yvuaO8CLapI9

Malware Config

Targets

    • Target

      2025-07-04_0aa68a786697ce67af0b5e754035b1d8_black-basta_elex_hijackloader_icedid_rhadamanthys_xiaobaminer

    • Size

      3.0MB

    • MD5

      0aa68a786697ce67af0b5e754035b1d8

    • SHA1

      77082891f5aa78ef9581a9796cc7e897bdba05d9

    • SHA256

      27da37fd272632e4fa10be797d57d6916916d45183f420bdf88233d1fe70a633

    • SHA512

      6f079aaa940339906cd6a6ed8a825c5e4d91caa4092cb59e182ea044a422b8aeb6fae28ab6bed71b2f17f7a41cb97a3023dae901611165380a6bcee2c36e1452

    • SSDEEP

      49152:9bYwnzcErdA6TKxrua0vOnmx9dgjI45TMwwapIgTI:yvuaO8CLapI9

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks