MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b5b46b4477701ee884adc1a39cd4c556fa45e097426026ed5338c35cdf6bc26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Blackmoon

Vendor detections: 13

Intelligence 13 IOCs YARA 3 File information Comments

SHA256 hash:	7b5b46b4477701ee884adc1a39cd4c556fa45e097426026ed5338c35cdf6bc26
SHA3-384 hash:	80291a4b06e8e26cc443c429de19f2dad6e0bd29f8b1439c3ef77470665cc19dc1ca783f6a257dd2880b962fb438ad42
SHA1 hash:	0329377a53f3942ae1012a2053db8d0b4b785a66
MD5 hash:	0391f771ba020e5bd11fa364da3a4fd5
humanhash:	august-utah-ohio-zebra
File name:	F2.exe
Download:	download sample
Signature	Blackmoon Create hunting rule
File size:	721'920 bytes
First seen:	2024-11-25 07:18:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1ac190528f10119a3edb31242b1a7eec (2 x Blackmoon)
ssdeep	12288:5z4UfgS9ru58bxjyD0t71c6YXXxXadGPFiGQrhAiVdJItpM7+59MdOOoS:dhCC24tTYBeakGQNTV7OR5S
Threatray	28 similar samples on MalwareBazaar
TLSH	T19EE42361D8F0D4B4D57A0AF4B511353F82393B186B716E82A3ED236BA2777E0847D2C6
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Joker
Tags:	Blackmoon exe malware

Intelligence

File Origin

# of uploads :

# of downloads :

362

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

F2.exe

Verdict:

Malicious activity

Analysis date:

2024-11-25 07:22:52 UTC

Tags:

blackmoon

Link:

https://app.any.run/tasks/25e9a522-7346-419b-8608-62310cfabbbb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674424e8b31374f098342ca0

Tags:

blackmoon packed virus zusy

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

microsoft_visual_cc overlay packed packed packer_detected upx

Link:

https://www.filescan.io/uploads/674424ec4895432a28c7d497/reports/36e17028-4a75-4bd8-a7ff-5e803858005e/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/7b5b46b4477701ee884adc1a39cd4c556fa45e097426026ed5338c35cdf6bc26

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/92667e52-e759-48ea-ae7e-646d92387d62

Result

Threat name:

BlackMoon

Detection:

malicious

Classification:

rans.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1562109

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected unpacking (changes PE section rights)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Yara detected BlackMoon Ransomware

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7b5b46b4477701ee884adc1a39cd4c556fa45e097426026ed5338c35cdf6bc26

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b5b46b4477701ee884adc1a39cd4c556fa45e097426026ed5338c35cdf6bc26/

Threat name:

Win32.Infostealer.Tinba

Status:

Malicious

First seen:

2024-11-25 07:19:05 UTC

File Type:

PE (Exe)

AV detection:

18 of 38 (47.37%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pnnunncho4a65cck3qndttkmkvx2ixqjoqtae3wvgogdltpwxqta._file

Verdict:

malicious

Label(s):

krbanker

Blackmoon

17d2cc3c376542385fe208dae85a0beaa1a0e95b7e1c56b5f13d3306abef40ab

Blackmoon

1ae10a49db468f34d17c799404749596b32cb402b33dd174b90f60b8db7dee04

Blackmoon

5691193b351b122a3271377a892c82f88a210bdcf0b5e143079d65b2db78a53d

Blackmoon

78733eaf03e5c92ac2dfb0ad80ee8cc1981b94a68ceda1f5e8aaceca640b7ee4

Blackmoon

7b5b46b4477701ee884adc1a39cd4c556fa45e097426026ed5338c35cdf6bc26

Blackmoon

error

Blackmoon

+ 18 additional samples on MalwareBazaar

Result

Malware family:

blackmoon

Score:

10/10

Tags:

family:blackmoon banker discovery trojan

Link:

https://tria.ge/reports/241125-h5hh5s1ndj/

Behaviour

Suspicious use of SetWindowsHookEx

System Location Discovery: System Language Discovery

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/78c80923-fb1e-4bd5-8799-07c6275c4c08

Unpacked files

SH256 hash:

0f63d0cdd05e5308a25e9414136bbc2d1898ea3cfda9388d5af1796b47d40106

MD5 hash:

6206e7bd72ee6c7df5e2a13b19a05303

SHA1 hash:

88260d9da5e75ae2aa7d4a671de0e1807ebf006d

Link:

https://www.unpac.me/results/446330ab-91cf-41b0-bf25-8080fccb58c9/

SH256 hash:

e6e9e172eb09df481adbf02c1e26e9e94cf828a3135993ed8d86050c553c66c7

MD5 hash:

bf09f0e34ce9a426b101acd361dda03c

SHA1 hash:

03c2bdba514161a16fe86efb6650cc58d700060d

Link:

https://www.unpac.me/results/446330ab-91cf-41b0-bf25-8080fccb58c9/

SH256 hash:

06855e8157015027a3c7723db7b094ffb2e8fa89cd4d3657ff197fbb2559373e

MD5 hash:

634474b26a461281781056aed0b73f65

SHA1 hash:

cf6ee1cc0449101d51c6c478875c005c8394e499

Link:

https://www.unpac.me/results/446330ab-91cf-41b0-bf25-8080fccb58c9/

SH256 hash:

0ad69b7ceb13c4ddc79c8ee2213b06d9f9ad3f455e2be9abce5af001f1f363e6

MD5 hash:

7928ba246a383fc10cd113c962cdee1a

SHA1 hash:

c3497398783abda841cfee9c9f82d8385a4504a8

Detections:

BlackmoonBanker

MALWARE_Win_BlackMoon

Link:

https://www.unpac.me/results/446330ab-91cf-41b0-bf25-8080fccb58c9/

SH256 hash:

7b5b46b4477701ee884adc1a39cd4c556fa45e097426026ed5338c35cdf6bc26

MD5 hash:

0391f771ba020e5bd11fa364da3a4fd5

SHA1 hash:

0329377a53f3942ae1012a2053db8d0b4b785a66

Link:

https://www.unpac.me/results/446330ab-91cf-41b0-bf25-8080fccb58c9/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Blackmoon

exe 7b5b46b4477701ee884adc1a39cd4c556fa45e097426026ed5338c35cdf6bc26

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3303910/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
RAS_API	Uses Remote Access	RASAPI32.dll::RasHangUpA
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample