MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1e7478ebc4b374feb2964da15149281da610a4e5773b890b7c9cabb4469c29f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackShades


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1e7478ebc4b374feb2964da15149281da610a4e5773b890b7c9cabb4469c29f
SHA3-384 hash: dd71107764b83863c6d7e71e3208e1b8ad2b4d4bc4a7ca2593e2a985befdd3f9bae009d2abf42a250f631b7ac5180010
SHA1 hash: 2aef7227ebcc424b5f46c73ad2fbcd653a343c24
MD5 hash: 8a578084b0d8e203622ab2487fe71d8f
humanhash: bacon-jupiter-whiskey-magazine
File name:DHL Receipt #_pdf.exe
Download: download sample
Signature BlackShades
Create hunting rule
File size:1'498'624 bytes
First seen:2021-09-23 10:59:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:32hhDcnSvwZ44qwdgdHgpeQFBToguyUP7M+KtuvHc8MVUBXX:GESvz4FdgdceBguZzgo22hX
Threatray 936 similar samples on MalwareBazaar
TLSH T160651D254D6696F7D3FF872CD05C0B8EDBF5A483BBA18F0E988186C6065770BE98814D
Reporter abuse_ch
Tags:BlackShades DHL exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL Receipt #_pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-09-23 11:02:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f06494e7-a4f8-4a89-a595-a3d8aaaa14b7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/190718/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1037-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7efac4e2-80bd-4ea0-890e-da5742575980
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/856825
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Antivirus detection for dropped file
Disables the windows firewall (over ALG)
Drops PE files with benign system names
Found strings related to Crypto-Mining
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 489255 Sample: DHL Receipt #_pdf.exe Startdate: 23/09/2021 Architecture: WINDOWS Score: 100 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus detection for dropped file 2->58 60 Multi AV Scanner detection for dropped file 2->60 62 12 other signatures 2->62 8 DHL Receipt #_pdf.exe 3 2->8         started        process3 file4 42 C:\Users\user\...\DHL Receipt #_pdf.exe.log, ASCII 8->42 dropped 64 Injects a PE file into a foreign processes 8->64 12 DHL Receipt #_pdf.exe 1 21 8->12         started        signatures5 process6 dnsIp7 48 myhost.com 144.208.71.180, 49769, 49770, 49771 IMH-WESTUS United States 12->48 50 192.168.10.103, 9000 unknown unknown 12->50 52 192.168.2.1 unknown unknown 12->52 44 C:\Users\user\...\DHL Receipt #_pdfmgr.exe, PE32 12->44 dropped 46 C:\Users\user\AppData\Roaming\...\Svchost.exe, PE32 12->46 dropped 66 Installs a global keyboard hook 12->66 17 cmd.exe 1 12->17         started        20 cmd.exe 1 12->20         started        22 cmd.exe 1 12->22         started        24 3 other processes 12->24 file8 signatures9 process10 signatures11 54 Uses netsh to modify the Windows network and firewall settings 17->54 26 conhost.exe 17->26         started        28 netsh.exe 1 3 20->28         started        30 conhost.exe 20->30         started        32 conhost.exe 22->32         started        34 reg.exe 1 1 22->34         started        36 WerFault.exe 23 9 24->36         started        38 conhost.exe 24->38         started        40 conhost.exe 24->40         started        process12
Detection:
ramnit
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b1e7478ebc4b374feb2964da15149281da610a4e5773b890b7c9cabb4469c29f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-23 11:00:10 UTC
AV detection:
24 of 45 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=whtupdv4jm3u72zjmtnbkfesqhngccsok5z3refxzhflwrdjykpq._file
Verdict:
malicious
Similar samples:
13a721ad46cfe0131e3089ee1df6f7b9e824db76548819b7c2000d0a58030ad6
BlackShades
3e66d72e6cb4fab3bf03a7a1ba048e661b9669928a021140d4d0cde12ced097f
BlackShades
42f238bcb0dc59e15acc6e7f9d1cae5658aa1fc250e609ed4b2735923ae6da74
BlackShades
453e07776e07268a23e0f90a6dde1e3bc9f55179a6bf55853e5d60fc25f85f72
BlackShades
4ccfbfb6751aca04fdefe4f96f95a322ac9684d62dd79c5f7d142c24f30eb5e8
BlackShades
820c62207fb790251824280ec281caeb04dde02a3e0c895a9909f6e66c3fc2d4
BlackShades
861b97ac6104aec8ba2dd1bdc408ae8ba021aae1b7a3bde00ad9ff4e4e8490d3
BlackShades
e6db3b87b0baaae5362426062156828de499822d72f00854c353bd99b977bead
BlackShades
f82e7241cf49759096f5d3a02c2a516462eabaf07133ec61d61ad1496ae8bd66
BlackShades
+ 926 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion suricata upx
Link:
https://tria.ge/reports/210923-m3yvkaheck/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
UPX packed file
Contains code to disable Windows Defender
suricata: ET MALWARE Zbot Generic URI/Header Struct .bin
Unpacked files
SH256 hash:
6acf5a78c38e220ff16277110f469ce725c304abb0e13d797de6c3ee203f2775
MD5 hash:
fe9aad1c061588b2030129bac1b13815
SHA1 hash:
99f07fb2aaa637291476fde6cfd4921c835959d0
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
SH256 hash:
2e774712cc111cd4eb3a59b5a6f58fa2be9080813ed316f75bf99cdc66f60692
MD5 hash:
0fbea7227adab7d43daa5c3d1645bb1d
SHA1 hash:
536b3c19db69d59f55b55e2b79760b7c5fcced6b
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
SH256 hash:
ffc9384268e7b83bce58e3e86e3b19f9689552679026bb2cfb9951bc3b40f07b
MD5 hash:
4469d96da242213b46e390c215df3d60
SHA1 hash:
699f475b95dae504cc902762b9c0f7315616c895
Detections:
win_ramnit_g0
Create hunting rule
win_ramnit_g1
Create hunting rule
win_ramnit_auto
Create hunting rule
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
Parent samples :
d410461b6a41d5193c3920f152e2a263944ca330c11f3d306bc266281b93ce78
e08e0f0228a8e08b8330c46c01f7b185513be82682b41d031e86591d195f2e56
2f05200e09f38d2197fb48d265bcd4d050131f688ce51cf86478192df100d675
199533f77cb4331908a90346f24610888ef42d6dd2f9866b733752426702e737
33afd44ca2f375189b68c6ab3f410d45ae1547e20ae04ed5e4e3b36978fdba49
2aef6190fbec261019520c2e603024eb0abf68eaf2460b3ed7c03c14754e5a09
337463b61d271e4826a1c570e565fe58f42548247b20c9cc8d52e7342943606e
83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b
4f0790556072df8347f13be4fe3068c743b7a7f0dcefa155b434d8c408ec8d35
b1e7478ebc4b374feb2964da15149281da610a4e5773b890b7c9cabb4469c29f
2d5f86c5aea887418198a76538412499bbc1d000f633de6d613f32c82c7c5073
52c970b575040b26c6c357f1aa64288544578a229b9be70acd0f860f55cca346
70f62aa60264ce150e290264a190270ec0a66c84452981ea4cbee8d2a427acca
06f7c12171e1608547eb5ae2d39af72835519fdf56aaaeb1dcc6be853dac22a9
75a0a12b779dc49dee1cb4e27eb6362bae2bbde60c9754b12aed27d7f0b6d129
270ea6a72a4f9ab032ce73bd2ba9e9a207929f0d4041e2cb298a650d4d2062ed
ba33ab723fdac923f508eed7114aba2a370c6b7ecd3639dc588cd8fc0c865f34
SH256 hash:
04a1fe8e3d0f1112cd274b75559fea78fa9e873efb719001bd5480c4582799d0
MD5 hash:
fea9741cf5cb761ff4133120ded2176d
SHA1 hash:
25be4965f45af627f7477a45349e53b8d48a3509
Detections:
win_ramnit_g0
Create hunting rule
win_ramnit_auto
Create hunting rule
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
Parent samples :
d410461b6a41d5193c3920f152e2a263944ca330c11f3d306bc266281b93ce78
e08e0f0228a8e08b8330c46c01f7b185513be82682b41d031e86591d195f2e56
2f05200e09f38d2197fb48d265bcd4d050131f688ce51cf86478192df100d675
199533f77cb4331908a90346f24610888ef42d6dd2f9866b733752426702e737
33afd44ca2f375189b68c6ab3f410d45ae1547e20ae04ed5e4e3b36978fdba49
2aef6190fbec261019520c2e603024eb0abf68eaf2460b3ed7c03c14754e5a09
337463b61d271e4826a1c570e565fe58f42548247b20c9cc8d52e7342943606e
83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b
4f0790556072df8347f13be4fe3068c743b7a7f0dcefa155b434d8c408ec8d35
b1e7478ebc4b374feb2964da15149281da610a4e5773b890b7c9cabb4469c29f
2d5f86c5aea887418198a76538412499bbc1d000f633de6d613f32c82c7c5073
52c970b575040b26c6c357f1aa64288544578a229b9be70acd0f860f55cca346
70f62aa60264ce150e290264a190270ec0a66c84452981ea4cbee8d2a427acca
06f7c12171e1608547eb5ae2d39af72835519fdf56aaaeb1dcc6be853dac22a9
75a0a12b779dc49dee1cb4e27eb6362bae2bbde60c9754b12aed27d7f0b6d129
270ea6a72a4f9ab032ce73bd2ba9e9a207929f0d4041e2cb298a650d4d2062ed
ba33ab723fdac923f508eed7114aba2a370c6b7ecd3639dc588cd8fc0c865f34
SH256 hash:
d1a00d15756986093cb6fce33dc04c26a50518c08c3784fa724a49da5c0fa606
MD5 hash:
aa676fa132f2c7b5f6fb1fe6a546e98e
SHA1 hash:
54e57ba7aa935c15e0cee326d6d439e303587549
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
SH256 hash:
cf7f40d803dd72c06f0f5f26ba672d72cfce64ed45b823736d4c3b26afb04040
MD5 hash:
afbe067c622d2834c009c95c3a746485
SHA1 hash:
efa17cb87995bded6706a29358386f5c6fb26a75
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
SH256 hash:
43e38f251dbca9aa20f3470167e5427a7e7a7cdcd25f0b6b045ae8577cd3e345
MD5 hash:
f62ab5d3528d5a3b9e270ea1f9347868
SHA1 hash:
6a74e87711c615adbd9145f829a33f55b7e42dd6
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
SH256 hash:
5a430d8d11b6937eaebea343107dab60b451ca1824b8619a7972fdec945de987
MD5 hash:
206ad010f19cc9c7018602b027948247
SHA1 hash:
007a40ecb9bafbf41a9344cd57acc465b82f3fca
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
SH256 hash:
612aa972935159ce035c8c21c2e1d09d2032e4e5be431d43e6fa1621039b0724
MD5 hash:
bc36404c0bdc15f2195f0f04cd91e051
SHA1 hash:
d6b298eac64ee090f7fbe3ce20f8e29308cfa875
Detections:
win_ramnit_g0
Create hunting rule
win_ramnit_g1
Create hunting rule
win_ramnit_auto
Create hunting rule
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
SH256 hash:
b1e7478ebc4b374feb2964da15149281da610a4e5773b890b7c9cabb4469c29f
MD5 hash:
8a578084b0d8e203622ab2487fe71d8f
SHA1 hash:
2aef7227ebcc424b5f46c73ad2fbcd653a343c24
Link:
https://www.unpac.me/results/42ecccd5-dcb7-4d9e-8627-d5b49fdbe2b5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b1e7478ebc4b374feb2964da15149281da610a4e5773b890b7c9cabb4469c29f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_blackshades_w0
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190718/

Comments