MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackCat


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f
SHA3-384 hash: 1f89a1c9535d2b4c1564c7995d49dd0c76942219919e379a1f36fae9202aef22a624c77373fbf46823adb8bdd3e36ca3
SHA1 hash: e22436386688b5abe6780a462fd07cd12c3f3321
MD5 hash: fe16fa500584cb241532dc7cb75c1f53
humanhash: monkey-lima-blossom-september
File name:blackcat_redacted.exe
Download: download sample
Signature BlackCat
Create hunting rule
File size:3'068'928 bytes
First seen:2021-12-10 11:39:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 55c1bce75ad836c886b7fb6bca398063 (13 x BlackCat)
ssdeep 49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4NS/RgaJ2w1M:rAnCs8pVblGyNM+l4UxUc1BhFovww1M
TLSH T1CFE59E46FA4356ADCB971570305EB33AF63A491C602D9FA3E7E89D30FE2E71019C8619
Reporter f0wlsec
Tags:blackcat exe Ransomware


Avatar
f0wlsec
BlackCat Ransomware, implemented in Rust. Sensitive victim information has been redacted.

Intelligence

File Origin
# of uploads :
1
# of downloads :
619
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
blackcat_redacted.exe
Verdict:
Suspicious activity
Analysis date:
2021-12-10 11:40:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b6db43ae-e249-4f4e-bdea-033e338ead83

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/213150/
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/1540/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/61b33c974d8e6f3a5e1f3b06/reports/dab816df-db16-4031-be2d-2fdeb7cbf8a3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d2b3572a-3016-4a50-8189-ec3ad032dcee
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/905288
Signature
Deletes shadow drive data (may be related to ransomware)
Found Tor onion address
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f/
Threat name:
Win32.Ransomware.BlackCat
Create hunting rule
Status:
Suspicious
First seen:
2021-12-10 11:40:18 UTC
File Type:
PE (Exe)
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211210-nswg5agcd9/
Unpacked files
SH256 hash:
59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f
MD5 hash:
fe16fa500584cb241532dc7cb75c1f53
SHA1 hash:
e22436386688b5abe6780a462fd07cd12c3f3321
Link:
https://www.unpac.me/results/23eb3bc2-376e-4478-94e4-435a397788a8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
Author:ditekSHen
Description:Detects executables containing commands for clearing Windows Event Logs
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Author:ditekSHen
Description:detects command variations typically used by ransomware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1468713125457371139
Cape
Cape
https://www.capesandbox.com/analysis/213150/

Comments