blackmoon | ac442c0b864c77d7929629c87ac0527a7111b9a779d0600fe1224348100731e1

General

Target
2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
Size 9.6MB
Sample260415-fbkejaez2q
SHA256 ac442c0b864c77d7929629c87ac0527a7111b9a779d0600fe1224348100731e1
MD5 9b23fb4d8a8e5c56b0daf9a08e3ef6e8
SHA1 3d235440547f4d4bd7acdd72aedb9c166a184da4
SHA512 aaf52bda4f1843d827a96e9a3a40b3ca7857a95e3ac00a41296c589635f0f606d5e6d814116ed317058688cfcc1134c71fa40eebd84088f2dd5fbf21ca7fd414
SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
TLSH
T1FDA6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
- Size 9.6MB
- SHA256 ac442c0b864c77d7929629c87ac0527a7111b9a779d0600fe1224348100731e1
- MD5 9b23fb4d8a8e5c56b0daf9a08e3ef6e8
- SHA1 3d235440547f4d4bd7acdd72aedb9c166a184da4
- SHA512 aaf52bda4f1843d827a96e9a3a40b3ca7857a95e3ac00a41296c589635f0f606d5e6d814116ed317058688cfcc1134c71fa40eebd84088f2dd5fbf21ca7fd414
- SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
- TLSH
  T1FDA6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker discovery blackmoon mimikatz installer trojan upx
- Detect Blackmoon payload
- Family: Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Family: Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Custom signature
  
  UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Executes dropped EXE
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2