MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a58b7bd1380f220770408e33f43bdac4ab0bfe336e101484100915bf0518e794. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Blackmoon


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a58b7bd1380f220770408e33f43bdac4ab0bfe336e101484100915bf0518e794
SHA3-384 hash: 6649abc0c98ce7e7a0d7d0798b6f3c7fdc43347d32aaf8d923071eea06034dd91bdc4ae9f362208f4e0849ee7c50efbc
SHA1 hash: 81d7eec4135a2cde0d29bf651eb3b8e1f4093a93
MD5 hash: d64c8e67eaa9bb5b648f7aa4731c2924
humanhash: music-helium-march-texas
File name:Chrome.exe
Download: download sample
Signature Blackmoon
Create hunting rule
File size:4'842'920 bytes
First seen:2024-07-30 09:40:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c1f9ea6d51ba4934aeaee8b1f7d283d7 (2 x CoinMiner, 1 x FatalRAT, 1 x Blackmoon)
ssdeep 98304:jDN3JGPpKZ9AaI7S2DLpKNbEoH6ErTQyQzPm1XUxIyiVni:jJ34UwF7S2DLpKNEoHj58PDxdii
TLSH T1E826333CBE54E949E9056F354D973B612CF47E234A4A74D3C2E9EA1862B3ECEE600714
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4504/4/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 696a6ee2b2b2c2cc (18 x RedLineStealer, 17 x LummaStealer, 16 x CoinMiner)
Reporter vm001cn
Tags:Blackmoon exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
415
Origin country :
HK HK
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Chrome.zip
Verdict:
Malicious activity
Analysis date:
2024-07-30 09:36:23 UTC
Tags:
upx aspack
Link:
https://app.any.run/tasks/2922a88d-b552-4d9b-845e-0f3a3d37b103

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a8b534c06bd32e596e6dd8
Tags:
Banker Encryption Network Other Ransomware Stealth Dexter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the Program Files subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Searching for synchronization primitives
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Blocking the User Account Control
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
fingerprint hook keylogger lolbin packed packed packed shell32 upx
Link:
https://www.filescan.io/uploads/66a8b5314c5c17942a801099/reports/225efd78-25b0-4ebd-bd03-f8dd61472c79/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/a58b7bd1380f220770408e33f43bdac4ab0bfe336e101484100915bf0518e794
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/3a1adb44-5532-4166-bc00-2627e2d7178f
Result
Threat name:
BlackMoon
Create hunting rule
Detection:
malicious
Classification:
rans.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1484569
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Disables UAC (registry)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sigma detected: Execution from Suspicious Folder
Sigma detected: Suspicious Program Location with Network Connections
Writes to foreign memory regions
Yara detected BlackMoon Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1484569 Sample: Chrome.exe Startdate: 30/07/2024 Architecture: WINDOWS Score: 100 60 seo.wccabc.com 2->60 62 dows.enigmacn.top 2->62 68 Malicious sample detected (through community Yara rule) 2->68 70 Multi AV Scanner detection for dropped file 2->70 72 Multi AV Scanner detection for submitted file 2->72 74 7 other signatures 2->74 10 Chrome.exe 7 2->10         started        14 PTvrst.exe 2->14         started        16 PTvrst.exe 2->16         started        signatures3 process4 file5 56 C:\Program Files (x86)\uzj.exe, PE32 10->56 dropped 58 C:\Program Files (x86)\ChromeSetup.exe, PE32 10->58 dropped 94 Contains functionality to register a low level keyboard hook 10->94 18 uzj.exe 3 11 10->18         started        23 cmd.exe 1 10->23         started        96 Writes to foreign memory regions 14->96 98 Allocates memory in foreign processes 14->98 100 Injects a PE file into a foreign processes 14->100 25 spolsvt.exe 2 14->25         started        signatures6 process7 dnsIp8 64 dows.enigmacn.top 188.114.96.3, 443, 49732 CLOUDFLARENETUS European Union 18->64 46 C:\Users\Public\Documents\...\audidog.exe, PE32 18->46 dropped 48 C:\Users\Public\Documents\sougou\PTvrst.exe, PE32 18->48 dropped 50 C:\Users\Public\Documents\...\spolsvt.exe, PE32 18->50 dropped 76 Disables UAC (registry) 18->76 27 PTvrst.exe 18->27         started        30 conhost.exe 23->30         started        78 Writes to foreign memory regions 25->78 80 Allocates memory in foreign processes 25->80 82 Injects a PE file into a foreign processes 25->82 32 spolsvt.exe 25->32         started        34 svcoth.exe 25->34         started        file9 signatures10 process11 signatures12 102 Multi AV Scanner detection for dropped file 27->102 104 Detected unpacking (changes PE section rights) 27->104 106 Machine Learning detection for dropped file 27->106 108 3 other signatures 27->108 36 spolsvt.exe 6 27->36         started        process13 file14 52 C:\Users\Public\Documents\uu\svcoth.exe, PE32 36->52 dropped 54 C:\Users\Public\Documents\dd\spolsvt.exe, PE32 36->54 dropped 84 Contains functionality to inject code into remote processes 36->84 86 Writes to foreign memory regions 36->86 88 Allocates memory in foreign processes 36->88 90 Injects a PE file into a foreign processes 36->90 40 spolsvt.exe 5 36->40         started        44 svcoth.exe 36->44         started        signatures15 process16 dnsIp17 66 seo.wccabc.com 8.218.228.132, 3928, 49735, 49737 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 40->66 92 Creates an undocumented autostart registry key 40->92 signatures18
Score:
76%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a58b7bd1380f220770408e33f43bdac4ab0bfe336e101484100915bf0518e794
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a58b7bd1380f220770408e33f43bdac4ab0bfe336e101484100915bf0518e794/
Threat name:
Win32.Infostealer.BlackMoon
Create hunting rule
Status:
Malicious
First seen:
2024-07-30 09:41:11 UTC
File Type:
PE (Exe)
Extracted files:
31
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uwfxxujyb4rao4caryz7io62ysvqx7rtnyibjbaqbek36biy46ka._file
Verdict:
unknown
Result
Malware family:
fatalrat
Create hunting rule
Score:
  10/10
Tags:
family:fatalrat aspackv2 discovery evasion infostealer persistence rat trojan upx
Link:
https://tria.ge/reports/240730-lnrl9szhjf/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
ASPack v2.12-2.42
Checks computer location settings
Deletes itself
Executes dropped EXE
Loads dropped DLL
UPX packed file
Fatal Rat payload
FatalRat
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b4d3ed85-a61a-40ad-ab52-779cf1f2fa3b
Unpacked files
SH256 hash:
d1ffc93730af2f015a6d31c5e7f38140b8cef421408411f32d534d8214c9ef0d
MD5 hash:
adbe646e7b2341a14734475fdab6f2c0
SHA1 hash:
d4268c07dfe20e6aef79843a4cf344a95b2b4005
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
bb0d10639b115283b48225473b5499d4b5abf509f2eadc299f1604048311dc5b
MD5 hash:
71ac0e312d2756360d001cf0fbc6233a
SHA1 hash:
e681293f4801a6de47a42380cf0511404b132bc5
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
MD5 hash:
523d5c39f9d8d2375c3df68251fa2249
SHA1 hash:
d4ed365c44bec9246fc1a65a32a7791792647a10
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
79cdf7ee71846b73df49ded887c0d7c141e66a4d4783875f9c0615ae837ff7a8
MD5 hash:
43f6308d7b95749f64bffab2f6f4ffad
SHA1 hash:
83caacaa67556fedfb3d9ad52fa6e3df62682ca2
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
MD5 hash:
d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 hash:
8ea2c85e363f551a159fabd65377affed4e417a1
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
01ef0d37701f46f5d788a07dfd8323f4a675e15711582655cab2130c7006ec04
MD5 hash:
d8cec8c6175c36aa412096745fa4f402
SHA1 hash:
934c5ef76e290cbf4f53aec136e7af5c5927a8ec
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
69f404aff3688fb4224540330e88a1fe0d244e2bca7a99b5a8e1dc88f7345704
MD5 hash:
c4a29c7f73cf69486b8f6d20d101bba7
SHA1 hash:
38d14c59618395204143f569700a65c6b0a4a719
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
d1093a47a39980c8f826a0eca79e3bf4cf68e82d6ec37456c647367c70ee5aef
MD5 hash:
db52f54569ecd8ce96a1526ccc674af1
SHA1 hash:
dc70830081e256fa0459097f2cf8077094d631fa
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
02c1f0772fd921a158925c6f727d812a243197c12d7d3d010f22d801ba84acf9
MD5 hash:
025523492a698abe3eaed965fad9514a
SHA1 hash:
79993dd2521b50cdbd68a115517ab0a1c918b23f
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
52ceb8207c440eca57ef075d8dbc9a42152f6dfe0947af72867a395e64e63188
MD5 hash:
2d841f978bdcd5aefc9b256f8946301b
SHA1 hash:
34cf2bc7df05e34afc9034716f63023f65dcac59
Detections:
Chinese_Hacktool_1014
Create hunting rule
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
SH256 hash:
a58b7bd1380f220770408e33f43bdac4ab0bfe336e101484100915bf0518e794
MD5 hash:
d64c8e67eaa9bb5b648f7aa4731c2924
SHA1 hash:
81d7eec4135a2cde0d29bf651eb3b8e1f4093a93
Link:
https://www.unpac.me/results/0d57b034-5c5f-4f32-b2ac-50cfd1349a75/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a58b7bd1380f220770408e33f43bdac4ab0bfe336e101484100915bf0518e794

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::FreeSid
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments