blackmoon | 0e63024dd1da9a2cdd3dba8ede3d25b00109e2c703bbc11fd7dafff0511c86ec

General

Target
0e63024dd1da9a2cdd3dba8ede3d25b00109e2c703bbc11fd7dafff0511c86ec
Size 474KB
Sample260501-p5ynpabv3m
SHA256 0e63024dd1da9a2cdd3dba8ede3d25b00109e2c703bbc11fd7dafff0511c86ec
MD5 cba8fe5f289e096d991fb29ecb8d54d4
SHA1 a3cf3a85f05d95a1142c295363729d93fe44bf40
SHA512 135d73d69ab5b25c52c64b9df79e42ba4db80567eeb6d072c1402f542bc55370c0a9770312aa3246db58f8baab14b02083e7952b9ac98efbedc48237f8051441
SSDEEP 12288:njWPl/JE/gR/jkXbWooD13vAINenisw9casZ7+3dQ1tP:njWPlhE/gR/QXbWooD13vAINeisw9hml
TLSH
T140A429237221F0A2C01D7BF51AD61B28BDF847143D7899339FE8AE667CB6562873640D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://156.239.252.191:448/j.ad

Attributes

access_type
512
host
156.239.252.191,/j.ad
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
448
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjnoRzKIdGsUe2rAWfB9RrSEi7C8biWT6XDImhJJSyt9dnnKDFtWhxE8el9kOw6W1LioOm44hB+OLknpSfCQOhaTRGC5GvYT1yERRKALA80Hu0AjezslSM6wpqscnbzZSeIA0wJKZu820GSJI77g05Cc+kZxmeDPpMBd9Y/eOC0wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; NP06)
watermark
100000

Targets

- Target
  0e63024dd1da9a2cdd3dba8ede3d25b00109e2c703bbc11fd7dafff0511c86ec
- Size 474KB
- SHA256 0e63024dd1da9a2cdd3dba8ede3d25b00109e2c703bbc11fd7dafff0511c86ec
- MD5 cba8fe5f289e096d991fb29ecb8d54d4
- SHA1 a3cf3a85f05d95a1142c295363729d93fe44bf40
- SHA512 135d73d69ab5b25c52c64b9df79e42ba4db80567eeb6d072c1402f542bc55370c0a9770312aa3246db58f8baab14b02083e7952b9ac98efbedc48237f8051441
- SSDEEP 12288:njWPl/JE/gR/jkXbWooD13vAINenisw9casZ7+3dQ1tP:njWPlhE/gR/QXbWooD13vAINeisw9hml
- TLSH
  T140A429237221F0A2C01D7BF51AD61B28BDF847143D7899339FE8AE667CB6562873640D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor banker 100000 discovery blackmoon cobaltstrike persistence trojan
- Detect Blackmoon payload
- Family: Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Adds Run key to start application
  persistence
behavioral1 behavioral2