MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a33b31af132d492e1eb511ed37087a9c52af1f7dd575fa63634fa9b4170daaa7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
BlackShades
Vendor detections: 8
| SHA256 hash: | a33b31af132d492e1eb511ed37087a9c52af1f7dd575fa63634fa9b4170daaa7 |
|---|---|
| SHA3-384 hash: | 0ab0414565c64658234bf7f76509047ab6af43ffd29a3f41133c00068176d674a259f9c54f28919fed87c8d149b1543f |
| SHA1 hash: | 84f3effef84e9fc8ad453967eb7f9e1fc9ea024e |
| MD5 hash: | d409d80870557b3c05f6d9696045bcd9 |
| humanhash: | hotel-missouri-oranges-chicken |
| File name: | d409d808_by_Libranalysis |
| Download: | download sample |
| Signature | BlackShades |
| File size: | 756'752 bytes |
| First seen: | 2021-05-05 09:06:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:Ygh3VMQ0rPlb2NWIOeLxHsH+1Z3uZJGheglDrvXp3NMN1GvIlBAqA0B:Yy9GKWIOeLNXvuZ8s0HpdM8IjAH0B |
| Threatray | 1'190 similar samples on MalwareBazaar |
| TLSH | D6F423A6519A6C72D66B13BB421BD0DD87629D86D43B936703FC6CC33EE77440E28878 |
| Reporter |  Libranalysis |
| Tags: | BlackShades |
Intelligence
File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file
Enabling the 'hidden' option for recently created files
Running batch commands
Creating a process with a hidden window
DNS request
Connection attempt
Launching a process
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Creating a file in the mass storage device
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Firewall traversal
Enabling autorun
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Worm.Ainslot
Status:
Malicious
First seen:
2020-05-03 23:52:04 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 1'180 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
bootkit evasion persistence upx
Behaviour
Modifies registry class
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Writes to the Master Boot Record (MBR)
Loads dropped DLL
Uses the VBS compiler for execution
Adds policy Run key to start application
Executes dropped EXE
Modifies Installed Components in the registry
UPX packed file
Modifies firewall policy service
Unpacked files
SH256 hash:
b561d05505f93ad7f7dc3c674af1dfa03ceed06919e99fa731cc2832a32567a1
MD5 hash:
be65ea0670602924255eb3398e1d7886
SHA1 hash:
2365cbf619f74f8f56c1957d08158565adf93906
Detections:
win_blackshades_w0
SH256 hash:
2d4b095497da943d08202a226dd07e5d49259dd00a2d6887a3c300da61a13a84
MD5 hash:
685419db11d9ffba4ed196f6ef583f88
SHA1 hash:
c1fd43efd4b8c186f171768077a137c1829657bc
SH256 hash:
819532b8f9ec59f1cce0c20d5bdf719b49baabe7febda3e3c9ce9f02b6737913
MD5 hash:
53a94e57e056f3dd38d6dad8768f3c26
SHA1 hash:
d0a9d36f0f0daca2a1b0c5decfa664b5cb6690b7
SH256 hash:
37e9892e5df207b6d045251a3ac39530575624354dc9379c073edac133963049
MD5 hash:
74d65db8e7f1ddb2630c83ca7c7c9f34
SHA1 hash:
2b2c7134e9fed54470340eac4027f67413078bfc
SH256 hash:
3d16d7b22df73500093c9b46201fedf8588165c8e8bf0cd9df877e8ab1925c47
MD5 hash:
a2f2b390fcbc9a59f9fded33f888e245
SHA1 hash:
b00c14819e451e615f8ad8999855a709db256a10
SH256 hash:
3439be9c5dc2c7a22bcdbbd80dd5315f3e8c7f57980f5e2157495a13eb5be2ce
MD5 hash:
dea0d91e41746cc29546bafcd74c9b16
SHA1 hash:
34f8ff210cf39d155d1a42a5c2f2ae7ea01950d5
SH256 hash:
a33b31af132d492e1eb511ed37087a9c52af1f7dd575fa63634fa9b4170daaa7
MD5 hash:
d409d80870557b3c05f6d9696045bcd9
SHA1 hash:
84f3effef84e9fc8ad453967eb7f9e1fc9ea024e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Keylog_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Contains Keylog |
| Rule name: | MALWARE_Win_BlackshadesRAT |
|---|---|
| Author: | ditekSHen |
| Description: | BlackshadesRAT POS payload |
| Rule name: | pe_imphash |
|---|
| Rule name: | RAT_BlackShades |
|---|---|
| Author: | Brian Wallace (@botnet_hunter) |
| Description: | Detects BlackShades RAT |
| Reference: | http://blog.cylance.com/a-study-in-bots-blackshades-net |
| Rule name: | Select_from_enumeration |
|---|---|
| Author: | James_inthe_box |
| Description: | IP and port combo |
| Rule name: | suspicious_packer_section |
|---|---|
| Author: | @j0sm1 |
| Description: | The packer/protector section names/keywords |
| Reference: | http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/ |
| Rule name: | win_blackshades_w0 |
|---|---|
| Author: | Jean-Philippe Teissier / @Jipe_ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.