MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackCat


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161
SHA3-384 hash: 9d8aa030c88c33f39b6b8ee59c77d8199f217045cef321b28697cd1240d04c2a024940fce106f55e2b6d69327d905c71
SHA1 hash: a186c08d3d10885ebb129b1a0d8ea0da056fc362
MD5 hash: 173c4085c23080d9fb19280cc507d28d
humanhash: ohio-fourteen-mobile-pennsylvania
File name:veros5.exe
Download: download sample
Signature BlackCat
Create hunting rule
File size:3'068'928 bytes
First seen:2021-12-10 19:32:13 UTC
Last seen:2022-06-21 10:47:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 55c1bce75ad836c886b7fb6bca398063 (13 x BlackCat)
ssdeep 49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4N1/RgaJ2w1M:rAnCs8pVblGyNM+l4UxUc1BhFDvww1M
TLSH T1C1E59E46FA4356ADCB971570305EB33AF63A491C602D9FA3E7E89D30FE2E71019C8619
Reporter Sh0ckFR
Tags:blackcat BlackCat Indicators exe Ransomware

Intelligence

File Origin
# of uploads :
3
# of downloads :
765
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161
Verdict:
Suspicious activity
Analysis date:
2021-12-10 11:17:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ef811038-48eb-4f58-98b1-69168942e7cf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/213251/
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/1599/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug exploit greyware
Link:
https://www.filescan.io/uploads/61b3ab6f4d8e6f3a5e201cd8/reports/5ad36e1a-0eee-415b-bd3c-2ee75cffd944/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/debfbf78-b14f-4295-ad42-ace6563160c5
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/905552
Signature
Deletes shadow drive data (may be related to ransomware)
Found Tor onion address
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161/
Threat name:
Win32.Ransomware.BlackCat
Create hunting rule
Status:
Malicious
First seen:
2021-12-10 19:33:11 UTC
File Type:
PE (Exe)
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Verdict:
malicious
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211210-x9hf9sbabn/
Unpacked files
SH256 hash:
731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161
MD5 hash:
173c4085c23080d9fb19280cc507d28d
SHA1 hash:
a186c08d3d10885ebb129b1a0d8ea0da056fc362
Link:
https://www.unpac.me/results/acaccb3c-6d0e-4bec-aba2-667665b2b5ac/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
Author:ditekSHen
Description:Detects executables containing commands for clearing Windows Event Logs
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Author:ditekSHen
Description:detects command variations typically used by ransomware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.bleepingcomputer.com/news/security/alphv-blackcat-this-years-most-sophisticated-ransomware/
Cape
Cape
https://www.capesandbox.com/analysis/213251/

Comments