✕
Request a Demo
Rewterz
Rewterz Threat Alert – Quasar RAT – Active IOCs
April 6, 2022
Rewterz
Rewterz Threat Advisory – Multiple Mozilla Firefox Vulnerabilities
April 6, 2022

Rewterz Threat Alert – BlackMoon Banking Trojan – Active IOCs

Severity

High

Analysis Summary

BlackMoon, aka KRBanker, is a banking trojan it can steal financial and banking account information as well as other sensitive data. Blackmoon was discovered in 2014 by Fortinet researchers, and it is back again with a new campaign. Blackmoon used to attack the host with URLs, advertisements, and other web content. Once the host has been compromised it can open multiple pop-ups.

Impact

  • Credential Theft
  • Financial Theft
  • Data Exfiltration

Indicators of Compromise

MD5

  • ea16b5ed06d884a785576d4f52ef4037
  • 0bba7f11a1dcfd807f22e6017647c05f
  • 6d903af30def706efdc95763166be19b
  • d71fdfbf9ffc924c5c427c859db53137
  • c56fd1f7791e4e57b1f627bc8de47d85

SHA-256

  • 576c808913384a04d7d2c16f30b53ee51c2786b7f7c94d9e3f1b0f11aa237023
  • 38262aeed1fa70b6f30f198b09d1fa122926ec5a6b170e2e18ab6da769bd2c97
  • fe7af374e0336118189c4b850b9c2dc16baa0c7dde4de8f1ef321828fd3b8a09
  • f7c7f840f2df87fbb8ac886212d0bb53cd24b6f383d1348fc9714b000cba311a
  • 795fbf405b6fdb9e3d3276bfb5ff6ba4a07495841de6997e3fe4a47f60f552b9

SHA-1

  • dc2c2e3b6d1b4104289a69c364944ea12cd6f89c
  • 7b5f85dccc64f0ace6a7139529990b5cd8cce231
  • d778b99f5eeb5f7c10a65d84ce478b19680d8ce5
  • d49e9af6a683ec39e7cb936386d2271138a9387c
  • bee2f73685c0d3e2103ac19e1b101e773c9b9788

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.