MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 145af39418607f9a21c35aaa855b65e8019c4d35750cb70d515f9807b43a3f21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Blackmoon

Vendor detections: 12

Intelligence 12 IOCs YARA 13 File information Comments

SHA256 hash:	145af39418607f9a21c35aaa855b65e8019c4d35750cb70d515f9807b43a3f21
SHA3-384 hash:	1edeccebdd8066808a5beb2618cbaa0f18cb5b592dec590c7c718b7b5656212d9b5763610ae323992a0d89006f27ad49
SHA1 hash:	5043b80e44a14c704abbabe58c3c405c255c6a87
MD5 hash:	b4b622dd6692b0185bd1a284ac849d2f
humanhash:	purple-failed-chicken-alabama
File name:	允许注销@121.62.63.92.exe
Download:	download sample
Signature	Blackmoon Create hunting rule
File size:	856'576 bytes
First seen:	2024-05-07 01:18:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ffb169cf03ac3d4750dd8e3783007a92 (5 x Blackmoon)
ssdeep	24576:TFYLJfZXhoXnH0WahXUvK3QyOOrTxW7+EmTRR3QxgGVLWv2Pxw:TSBL43P2
Threatray	783 similar samples on MalwareBazaar
TLSH	T1AC053A237221C0A3C1612FF957AA163838F847152D79A963AFD8AEA67CB4533CF3550D
TrID	38.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 20.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.6% (.SCR) Windows screen saver (13097/50/3) 6.9% (.EXE) Win64 Executable (generic) (10523/12/4)
File icon (PE):
dhash icon	ccaa33cacab3b2ec (15 x Blackmoon, 1 x Gh0stRAT)
Reporter	bobross_malware2
Tags:	Blackmoon exe

Intelligence

File Origin

# of uploads :

# of downloads :

305

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

145af39418607f9a21c35aaa855b65e8019c4d35750cb70d515f9807b43a3f21.exe

Verdict:

Suspicious activity

Analysis date:

2024-05-07 01:23:04 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/055d6ed8-0193-474a-9b50-8f439c5c7a24

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Dropper.Tiggre-9845940-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Connection attempt

Sending an HTTP GET request

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/145af39418607f9a21c35aaa855b65e8019c4d35750cb70d515f9807b43a3f21

Malware family:

XiaoBa

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0042466e-3a3b-43fa-a9ad-e2fb52a670da

Result

Threat name:

BlackMoon

Detection:

malicious

Classification:

rans

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1437158

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected BlackMoon Ransomware

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/145af39418607f9a21c35aaa855b65e8019c4d35750cb70d515f9807b43a3f21

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/145af39418607f9a21c35aaa855b65e8019c4d35750cb70d515f9807b43a3f21/

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2024-05-06 17:55:55 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=crnphfaymb7zuiodlkvikw3f5aazytjvouglodkrl6mapnb2h4qq._file

Verdict:

malicious

Blackmoon

2647ffc24cdbf437e5de3a9b81f44aabe509d2f5268b0f622e11279a5091439a

Blackmoon

60ec93f714e4836a76689d8e332d650a4690a38896bda64e2c23882dc1416dd6

Blackmoon

963464bdf5a8f186cb15b7dc1fb9a06af7c3d5b20e77b507b12d3e3ebe3f1742

Blackmoon

aa70bd523dd06f707ea78850e005d7a657bcbc7c2e34afe60bd46dbc9a69a1b4

Blackmoon

c2bdf8928c73388a807ad12f4f080b1ac39fe6cdf8a2e041bcfed83ccd804356

Blackmoon

cceab4dfe2d1111cca2e13c47ab9cf2053fd4761684a3792e500250b906275a1

Blackmoon

d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7

Blackmoon

+ 773 additional samples on MalwareBazaar

Result

Malware family:

blackmoon

Score:

10/10

Tags:

family:blackmoon banker persistence trojan

Link:

https://tria.ge/reports/240507-bpjmyabh8s/

Behaviour

Modifies Control Panel

Suspicious use of AdjustPrivilegeToken

Sets file execution options in registry

Blackmoon, KrBanker

Detect Blackmoon payload

Unpacked files

SH256 hash:

a8b191e27be3c026d5170f995f447f8d7da114faed86820b639434f836d0379c

MD5 hash:

bce4733c6eb5ebaec06cd23a28f059a1

SHA1 hash:

02dacfb3c952f1c94540505e292ad0d444504a51

Link:

https://www.unpac.me/results/442692a6-bbcd-4891-9c9f-2aeae0932a16/

SH256 hash:

97ea3d99cf21123bc1aec72f9ded6a51ac659830392adfefd424eb799ab0219e

MD5 hash:

8b3591965f623b219c0c528153746cab

SHA1 hash:

020961494fa0e08779b7aacf4422269935354f7d

Link:

https://www.unpac.me/results/442692a6-bbcd-4891-9c9f-2aeae0932a16/

SH256 hash:

11c46cb8f4208fd25c77cdc688204f3252b07b50c481c15454af745652d60784

MD5 hash:

01c05ffcec63e010eec4425c304ed371

SHA1 hash:

8d5ed0c3e4ed87f954d57be041e7ee366cd99350

Link:

https://www.unpac.me/results/442692a6-bbcd-4891-9c9f-2aeae0932a16/

SH256 hash:

145af39418607f9a21c35aaa855b65e8019c4d35750cb70d515f9807b43a3f21

MD5 hash:

b4b622dd6692b0185bd1a284ac849d2f

SHA1 hash:

5043b80e44a14c704abbabe58c3c405c255c6a87

Detections:

BlackmoonBanker

MALWARE_Win_BlackMoon

Link:

https://www.unpac.me/results/442692a6-bbcd-4891-9c9f-2aeae0932a16/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.84

Link:

https://yomi.yoroi.company/submissions/145af39418607f9a21c35aaa855b65e8019c4d35750cb70d515f9807b43a3f21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_BlackMoon Create hunting rule
Author:	ditekSHen
Description:	Detects executables using BlackMoon RunTime

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	Windows_Trojan_CobaltStrike_f0b627fc Create hunting rule
Description:	Rule for beacon reflective loader

Rule name:	Windows_Trojan_CobaltStrike_f0b627fc Create hunting rule
Author:	Elastic Security
Description:	Rule for beacon reflective loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Blackmoon

exe 145af39418607f9a21c35aaa855b65e8019c4d35750cb70d515f9807b43a3f21

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2840677/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high
CHECK_TRUST_INFO	Requires Elevated Execution (level:requireAdministrator)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CreateStreamOnHGlobal
DP_API	Uses DP API	CRYPT32.dll::CryptProtectData
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdipGetImageEncodersSize gdiplus.dll::GdipGetImageEncoders gdiplus.dll::GdipDeleteGraphics gdiplus.dll::GdipFillRectangle gdiplus.dll::GdipDeleteBrush
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.DLL::CreateProcessA KERNEL32.DLL::CloseHandle WINHTTP.dll::WinHttpCloseHandle KERNEL32.DLL::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA KERNEL32.DLL::GetStartupInfoA KERNEL32.DLL::GetCommandLineA KERNEL32.DLL::GetCommandLineW
WIN_BASE_IO_API	Can Create Files	KERNEL32.DLL::CreateDirectoryA KERNEL32.DLL::CreateDirectoryW KERNEL32.DLL::CreateFileA KERNEL32.DLL::DeleteFileA KERNEL32.DLL::MoveFileA SHLWAPI.dll::PathRemoveFileSpecW
WIN_HTTP_API	Uses HTTP services	WINHTTP.dll::WinHttpAddRequestHeaders WINHTTP.dll::WinHttpConnect WINHTTP.dll::WinHttpCrackUrl WINHTTP.dll::WinHttpOpenRequest WINHTTP.dll::WinHttpOpen WINHTTP.dll::WinHttpQueryDataAvailable
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExA ADVAPI32.dll::RegDeleteKeyA ADVAPI32.dll::RegOpenKeyA ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegQueryValueExA ADVAPI32.dll::RegSetValueExA
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::ControlService ADVAPI32.dll::CreateServiceA ADVAPI32.dll::OpenSCManagerA ADVAPI32.dll::OpenServiceA ADVAPI32.dll::StartServiceA
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuW USER32.dll::CreateMenu USER32.dll::FindWindowExA USER32.dll::FindWindowExW USER32.dll::PeekMessageA USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample