MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Blackmoon

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da
SHA3-384 hash:	602685e6fdf681d5b644ccdc4295e4748e9a6cca877084683be7bbe551290cb083e657f466e59d5096f4d4eed5a95747
SHA1 hash:	4d5629a5fbb29439b66caf98c5cec56730118ecd
MD5 hash:	214f53c5c0181d9e0531c48d46ed0881
humanhash:	music-charlie-cola-uniform
File name:	01930f_x86_exe.bin
Download:	download sample
Signature	Blackmoon Create hunting rule
File size:	446'464 bytes
First seen:	2026-10-12 20:50:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	a21638c38dfeb6a2bfe13a5306976bfe (1 x Blackmoon)
ssdeep	12288:UXx0QTpUFuegQsEAB+yGk//4Yre94vSZGk//4Yre9746T:Cx0QTpU38h3trEV3trx
TLSH	T136949E13B690C0B3E027227515F20B38EBBAF9211FB0562797A4CE794E72751FE36916
TrID	40.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 21.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 8.5% (.EXE) Win64 Executable (generic) (6522/11/2) 6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	Daydream
Tags:	Blackmoon exe PERSISTENCE privesc

Daydream

Main stage embedded in the UPX-unpacked TQ.jpg (5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd) at offset 0x1930f (stored as 'exe' + length). Holds four further programs. Strings: AddMonitorA and the print-monitor key SYSTEM\CurrentControlSet\Control\Print\Monitors\RunDllExe\Driver (stored XOR 0x10 as hex text), sethc/Utilman/osk/Magnify/Narrator paths, Windows Defender DisableAntiSpyware, MSSQLServer Setup SQLPath. TQ.jpg carries the Gh0stRAT label on MalwareBazaar, but we found no Gh0st code in it: it is a privilege-escalation and persistence bundle. Part of the toolkit served from down.ftp21.cc (TQ.jpg, wmi.jpg, 445.jpg, Win10.ps1), which targets Windows servers running SQL Server. Static analysis only; not executed by us.

Intelligence

File Origin

# of uploads :

# of downloads :

204

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

TQ.exe

Verdict:

Malicious activity

Analysis date:

2024-07-08 04:37:54 UTC

Tags:

upx blackmoon loader ip-check evasion

Link:

https://app.any.run/tasks/6b6e6d5d-a674-475a-a4e6-4b8baca7d713

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91595/

Detection(s):

Win.Dropper.Tiggre-9845940-0

Win.Trojan.Lazy-10031882-0

Win.Trojan.Zusy-10035801-0

YARA.DITEKSHEN_MALWARE_Win_Blackmoon.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad10c3cf4e17c78f715de34

Tags:

blackmoon emotet tiggre farfli

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the Windows subdirectories

Launching a service

Loading a suspicious library

Launching a process

Creating synchronization primitives

Creating a window

Adding an access-denied ACE

Connection attempt to an infection source

Sending a custom TCP request

Enabling autorun for a service

Enabling autorun

Blocking the Windows Defender launch

Query of malicious DNS domain

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug blackmoon cmd coinminer crypto evasive farfli keylogger lolbin masquerade microsoft_visual_cc reconnaissance

Link:

https://www.filescan.io/uploads/6acd484318bfd1652e1dd5c9/reports/49855850-53fc-4403-b4bb-e4a8c3426bd4/overview

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da

Verdict:

Malicious

File Type:

exe x32

First seen:

2024-06-19T22:37:00Z UTC

Last seen:

2026-10-13T05:15:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da/results?tab=lookup

Malware family:

KRBanker

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a075248e-1ba0-4fd2-9114-e3b14c51d302

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/214f53c5c0181d9e0531c48d46ed0881

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da/

Threat name:

Win32.Trojan.CobaltStrike

Status:

Malicious

First seen:

2024-06-22 09:29:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ejf7bpirt324rlwslb24wzxwf6pcavg6vdpfumedzrbuncs5udna._file

Verdict:

malicious

Label(s):

KrBanker

Link:

https://reports.threatray.com/5d5ab010-b067-4689-b06c-e392e54fe536

Result

Malware family:

gh0strat

Score:

10/10

Tags:

family:gh0strat discovery evasion persistence rat trojan

Link:

https://tria.ge/reports/261012-zqlexszzgv/

Behaviour

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

System Location Discovery: System Language Discovery

Drops file in Windows directory

Drops file in System32 directory

Executes dropped EXE

Boot or Logon Autostart Execution: Port Monitors

Family: Gh0strat

Gh0st RAT payload

Modifies Windows Defender DisableAntiSpyware settings

Unpacked files

SH256 hash:

224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da

MD5 hash:

214f53c5c0181d9e0531c48d46ed0881

SHA1 hash:

4d5629a5fbb29439b66caf98c5cec56730118ecd

Detections:

BlackmoonBanker

INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

MALWARE_Win_BlackMoon

Link:

https://www.unpac.me/results/03378b3d-7805-4503-b765-a5ef2689d339/

Parent samples :

5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd
224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da

Malware family:

BlackMoon

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/224bf0bd119e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.