Overview

overview

10

Static

static

7

6156d5d11c...3a.exe

windows10-2004-x64

10

6156d5d11c...3a.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6156d5d11c6703b1723aa04ddb7b5b8979b23bf7b249c2550baf43c3ce1c673a
  • Size 9.0MB
  • Sample260511-y9h88sdw8p
  • SHA256 6156d5d11c6703b1723aa04ddb7b5b8979b23bf7b249c2550baf43c3ce1c673a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
blackmoonaspackv2bankerdefense_evasiondiscoveryexploittrojanupx

Malware Config

Targets

    • Target
      6156d5d11c6703b1723aa04ddb7b5b8979b23bf7b249c2550baf43c3ce1c673a
    • Size 9.0MB
    • SHA256 6156d5d11c6703b1723aa04ddb7b5b8979b23bf7b249c2550baf43c3ce1c673a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankerdefense_evasiondiscoveryexploitblackmoontrojanupx

    • Detect Blackmoon payload

    • Family: Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Drops file in Drivers directory

    • Possible privilege escalation attempt

      exploit

    • Modifies file permissions

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks