Severity
High
Analysis Summary
BlackMoon, also known as KrBanker, is a banking Trojan that first emerged in September 2015, initially targeting South Korean banks using a pharming technique to redirect users to fake banking websites and steal credentials. Over the years, it has undergone significant evolution, shifting from simple credential theft to more complex, multi-stage attacks. By late 2022, BlackMoon began targeting businesses in the USA and Canada, focusing on long-term persistence, evasion, and the delivery of additional malware rather than just credential harvesting.
As of 2025, recent campaigns have demonstrated the Trojan's use of modular architecture, allowing it to download spyware, adware, and tools for lateral movement within corporate networks. It employs advanced evasion techniques such as signed and obfuscated binaries, encrypted command-and-control (C2) channels, and the abuse of legitimate system tools like PowerShell, making it difficult to detect. Additionally, it leverages vulnerabilities in outdated VPN software and remote access tools to gain initial access. BlackMoon has effectively transitioned into a stealthy platform for malware delivery and system compromise, posing a persistent threat to business environments in North America.
Impact
- Data Exfiltration
- Credential Theft
- Financial Loss
Indicators of Compromise
MD5
eb09b6d59e1d64263a92344156b6a2d4
372ea9b6ce638fd30a4221b01eed3ce1
3ddfd5c11540fef495833305197f78b7
dc474047a0b99f3ebaab42681a14ec75
c39755f3b92e0495fcc4a6e4467f5358
SHA-256
- 91753ff17b155f6d63b4577bbf54263da6c461924d810eea73e59447450099fb
- 4fedcc1d9103db0a0b60448aae036c659ee293ebb9f8a31e1ed620170fd4a5ae
- e67cecb7e8c1002f4870a47f020f30d19f569bf488142d518bf47c323a98265d
- 1c65d2c5776524e4bd54df868993c3697b4ebfe8e2215378a116127417d0568d
- a53e1d18920b0b2507e0700912ce056cdd15a10b33bd06f3f08e93c77d6d019f
SHA1
- fce2c4a883b444223a53fe0cb10273ad140d55ac
- 2fe6437c58591b271843dc43f8babdc9cd24f0c7
- 47ab84003e571209b327c20b1176668b9fc2cfbc
- 1bc3d17072ad9da08c86a768d1fd11a7649f2e54
- 84e8fedfa356f3ea8cd62d92c4c68ea164bf6c53
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Never trust or open links and attachments received from unknown sources/senders.
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
- Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.