blackmoon | f3bf36fd8c4a85b33b8a8dbf769dae3301d82ca1bfe26283ae33d429d6cfd983

General

Target
2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
Size 9.7MB
Sample260419-1962eaaz2k
SHA256 f3bf36fd8c4a85b33b8a8dbf769dae3301d82ca1bfe26283ae33d429d6cfd983
MD5 75f69b7f70129fdf1375e4fc62950ce5
SHA1 6ac8958e17399467ec341a1ef55c3e0379f3fc23
SHA512 4c716e4eab63bda6ea49d1e340d132c65699fdb39f39182d78ced2ed425946bfb3e0351530b9158f22fb8b6198d95b91f5f661f912dbc3ecd683ede8523391b4
SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
TLSH
T1D3A6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
- Size 9.7MB
- SHA256 f3bf36fd8c4a85b33b8a8dbf769dae3301d82ca1bfe26283ae33d429d6cfd983
- MD5 75f69b7f70129fdf1375e4fc62950ce5
- SHA1 6ac8958e17399467ec341a1ef55c3e0379f3fc23
- SHA512 4c716e4eab63bda6ea49d1e340d132c65699fdb39f39182d78ced2ed425946bfb3e0351530b9158f22fb8b6198d95b91f5f661f912dbc3ecd683ede8523391b4
- SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
- TLSH
  T1D3A6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker discovery blackmoon mimikatz installer trojan upx
- Detect Blackmoon payload
- Family: Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Family: Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Custom signature
  
  UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Executes dropped EXE
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2