MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d74db6d7705d15a9a3e25989d7c2983ff9ae2d4fbe561bc8a020c37eb3e2d3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Blackmoon


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d74db6d7705d15a9a3e25989d7c2983ff9ae2d4fbe561bc8a020c37eb3e2d3b
SHA3-384 hash: eea66f998020fc62af7fcc7a8a9752ed7e8f0e7761fb80d2c4340513cc8dd5961b7a9b0d914ce33e5e93c6abac0e7239
SHA1 hash: 6c3aa72a1ce4123992c9c495f5a7081e2c44136f
MD5 hash: af2286f2bb4b97d5d37b6116bdf4aa3a
humanhash: fish-gee-mockingbird-kentucky
File name:adb.exe
Download: download sample
Signature Blackmoon
Create hunting rule
File size:395'952 bytes
First seen:2021-03-06 00:04:33 UTC
Last seen:2021-03-06 00:07:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ef39d474ee88b9215814d74ee695b02b (13 x Gh0stRAT, 2 x Blackmoon)
ssdeep 6144:vGyne2Ko9cK2OHnV7D2djek72aTALaFIm85ZDOFBjb/8o05NYXafC2IxFa:em78gnV/2okya+bFOfv8t5NY12GFa
Threatray 30 similar samples on MalwareBazaar
TLSH DB841259BC4B1103EDC60F30D99445E709BD1E5B7A027CEFCB15F886ADF122C1AA8DA9
Reporter r3dbU7z
Tags:backdoor Blackmoon exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
413
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
adb.exe
Verdict:
No threats detected
Analysis date:
2021-03-06 00:07:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7684a49c-0e93-405e-bd77-c4bc3bf713dd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/122566/
Detection(s):
PUA.Win.Trojan.Winlock-6629293-0
Create hunting rule

SecuriteInfo.com.BackDoor.Generic19.BGQM.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/630344
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to capture and log keystrokes
Contains functionality to detect sleep reduction / modifications
Contains functionality to register a low level keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d74db6d7705d15a9a3e25989d7c2983ff9ae2d4fbe561bc8a020c37eb3e2d3b/
Threat name:
Win32.Backdoor.PcClient
Create hunting rule
Status:
Malicious
First seen:
2021-03-06 00:05:08 UTC
AV detection:
36 of 45 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pv2nw3lxaxivvgr6ewmj27bjqp7zvywu7pswdpekaigdp2z6fu5q._file
Verdict:
suspicious
Similar samples:
420c4a968b184211b9e5e2d26b5a460229249a6fbc5a3dbdba6b5096e4903b63
Blackmoon
50e90a38a2fda1a8a9c6ea93d9aafcb9a97271abf485b778a307e177e670ad4d
Blackmoon
82c8c241387c128a1d00eb9a96ec415ccad32461600441cb9a6c9176cfebd617
Blackmoon
851f2df17ce8673bc0747d4ec64b2904b3749a5e9028acbc65db70613b3e5ad5
Blackmoon
97896c9917071080e38b225728be3c5c203384c198da1fa59d701abdf7c40930
Blackmoon
9f905e04970d3c86d99ddb67052f2f948605a26891d085d1ab431a693260e155
Blackmoon
b19f2c2eec099ce6116313fff9348927a979584c82338f16c4f24231100dbd4b
Blackmoon
d494d1c9597021407f9167547604c663e7f70f705b5e70bfa207d346d9de7ae9
Blackmoon
f2e9b563cfb903599a87072f6f36d77c02eb4a9c885e7c8da435f4f02801ad15
Blackmoon
f7a8d3fb89711f208f281c267ed8dd647cda207ecb514d37892b56a0ddafbe9a
Blackmoon
+ 20 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210306-k7jql9k24n/
Behaviour
Checks processor information in registry
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
afe928daf4992e56d4d613df31927f945dfe81498186b9c37d9b1b7d8d1da136
MD5 hash:
275c4c032b08027cedf0cdb0b2dbfacc
SHA1 hash:
d943d34ac2e4d6f97318fcd2d60b098ea1a7ff40
Link:
https://www.unpac.me/results/7aedfedd-a6c9-4e67-b5d7-dbf8abd927e4/
Parent samples :
7c7edaf79218ec77462a5097f6860347b905b01ea8c1bc807f6731847770d9b2
222550d01c5123fd8ab3989ba63bd928e4dcc23f3c04c3895ec9afce7057d62c
770046d4a6f703dad79b1745b7913417f83201377915f7f3d0d85d2cf6efb335
72e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206
fc35c926288af736d9772f5a014d3cb703899feb7b5f7613d671381c1dfe9c50
2e389fca5fd7268bfed564c984ef9552d22629c482d9f88c8c122a5fbf9553c0
0e4db144b872080e865f2ce5d7dc2edeb47eb304d109c3f16c82c04ce626644f
0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d
9ab30823de1456e3176373b63d29e488f055648e1f00e9befbf241c54461613f
SH256 hash:
7d74db6d7705d15a9a3e25989d7c2983ff9ae2d4fbe561bc8a020c37eb3e2d3b
MD5 hash:
af2286f2bb4b97d5d37b6116bdf4aa3a
SHA1 hash:
6c3aa72a1ce4123992c9c495f5a7081e2c44136f
Link:
https://www.unpac.me/results/7aedfedd-a6c9-4e67-b5d7-dbf8abd927e4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farfli
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7d74db6d7705d15a9a3e25989d7c2983ff9ae2d4fbe561bc8a020c37eb3e2d3b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:upx_packed
Create hunting rule
Description:UPX packed file

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/122566/

Comments