MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
BlackMatter
Vendor detections: 15
| SHA256 hash: | a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db |
|---|---|
| SHA3-384 hash: | 57cad6fdc827b1283b841e2f794d53b2f118ceb64778ce383188b69c1c6bd6a6b8f0f9091de9a00fea0110d3b1c6654e |
| SHA1 hash: | d6ae7dc2462c8c35c4a074b0a62f07cfef873c77 |
| MD5 hash: | c2bc344f6dde0573ea9acdfb6698bf4c |
| humanhash: | yankee-sweet-magazine-alanine |
| File name: | builder.exe |
| Download: | download sample |
| Signature | BlackMatter |
| File size: | 480'768 bytes |
| First seen: | 2024-09-22 15:08:09 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d2e26e45dcb84f1062f90f29a9cf0faa (1 x BlackMatter) |
| ssdeep | 12288:CzVXpdg/1MB94JD7RfaVT1hG98P67PNV3giFH6J1VjR3L6dpbQrQyEpInmwuRUfB:CzxjgdRpBq1hG98P67PNV3giFH6J1Vjn |
| TLSH | T10EA48D11B225D073D07714F67B6BB129B3AF4D3C0A796803EAD41F0938B59A3AF11A5B |
| TrID | 36.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 19.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.4% (.EXE) Win64 Executable (generic) (10523/12/4) 7.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 5.9% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Magika | pebin |
| Reporter |  nickkuechel |
| Tags: | BlackMatter exe Ransomware |
Intelligence
File Origin
# of uploads :
1
# of downloads :
636
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
builder.exe
Verdict:
No threats detected
Analysis date:
2024-07-11 10:44:20 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Tags:
Malware Monitor Dropper
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm blackmatter filecoder fingerprint lockbit lolbin packed packed ransomware redcap shell32 zeroaccess
Verdict:
Malicious
Labled as:
Trojan.Generic
Malware family:
BlackMatter Ransomware
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.LockbitBuilder
Status:
Malicious
First seen:
2022-09-21 11:23:30 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
33 of 38 (86.84%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
lockbit
Score:
10/10
Tags:
family:blackmatter family:lockbit discovery
Behaviour
System Location Discovery: System Language Discovery
Verdict:
Malicious
Tags:
ransomware darkside lockbit
YARA:
RAN_Lockbit_v3_Jun_2022_1 Windows_Ransomware_Lockbit_369e1e94 DarkSide_BM LockBit3 MAL_RANSOM_Lockbit_Indicators_Feb24
Unpacked files
SH256 hash:
58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23
MD5 hash:
80eeb191abe38686038db7946e49774c
SHA1 hash:
49d136f1167ede48ebe38788030e40f8001f404a
Detections:
win_lockbit_auto
Darkside
SH256 hash:
3084551d7ccc8c2c3cdd9b301d1280229782ab54fb7ef346ea816d2cb3877aa6
MD5 hash:
040f8c4e8681ae0490e5125ca6606c3b
SHA1 hash:
1925dbca140160037d2bbb51709c833137b26b96
SH256 hash:
643e6e51e42a4274005b853efc80ad54e8f6c8aa113cf415fb8bdebcc7399b84
MD5 hash:
a23fe0cd95fd358590d2bb681d277f9e
SHA1 hash:
e48876d7beffd78e9d877892b29f35a45d28b159
Detections:
win_lockbit_auto
Darkside
SH256 hash:
d641ad955ef4cff5f0239072b3990d47e17b9840e07fd5feea93c372147313c5
MD5 hash:
94d6b5b569a64001859021e6e161d9fb
SHA1 hash:
44ace51ff88d2369f17d93ab82d71dde10bc468f
SH256 hash:
63c8efca0f52ebea1b3b2305e17580402f797a90611b3507fab6fffa7f700383
MD5 hash:
c804ef379e2f16e5afd0c448f72cccb8
SHA1 hash:
53f97950e64ba696a49781492a15ff879dc8614f
SH256 hash:
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
MD5 hash:
294e9f64cb1642dd89229fff0592856b
SHA1 hash:
97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SH256 hash:
a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
MD5 hash:
c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 hash:
d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
Detections:
win_lockbit_auto
Darkside
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CRIME_WIN32_RANSOM_BLACKMATTER |
|---|---|
| Author: | Rony (@r0ny_123) |
| Description: | Detects Blackmatter ransomware |
| Rule name: | Darkside |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies Darkside ransomware. |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Detect_APT29_WINELOADER_Backdoor |
|---|---|
| Author: | daniyyell |
| Description: | Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends |
| Reference: | https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties |
| Rule name: | HeavensGate |
|---|---|
| Author: | kevoreilly |
| Description: | Heaven's Gate: Switch from 32-bit to 64-mode |
| Rule name: | lb_apihashing_code_1 |
|---|---|
| Author: | 0x0d4y |
| Description: | This rule detects samples from the Lockbit3.0 (and BlackMatter) family unpacked in memory, identifying code reuse of key functions. |
| Rule name: | lb_keystream_shellcode_1 |
|---|---|
| Author: | 0x0d4y |
| Description: | This rule detects the Shellcode code pattern injected into memory to generate the decryption keystream. |
| Rule name: | lb_stack_string_decrypt_1 |
|---|---|
| Author: | CTI Purple Team |
| Description: | This rule detects the code pattern of the Stack Strings decryption algorithm. |
| Rule name: | LockBit3_ransomware |
|---|---|
| Author: | BlackBerry |
| Description: | Rule detecting Lockbit3 ransomware samples |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | RAN_Lockbit_v3_Jun_2022_1 |
|---|---|
| Author: | Arkbird_SOLG |
| Description: | Detect the lockbit ransomware |
| Reference: | https://twitter.com/vxunderground/status/1543661557883740161 |
| Rule name: | Windows_Ransomware_Lockbit_369e1e94 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_lockbit_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.lockbit. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::GetCommandLineW |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CreateFileW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.