MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Blackmoon

Vendor detections: 12

Intelligence 12 IOCs YARA 13 File information Comments

SHA256 hash:	d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7
SHA3-384 hash:	2550e9c4fc328ad5d278609c7ca3667e3c5f4956e290ccac81eeacdd8fecf33c963f076d2ec09b12debc696ec49c7b8f
SHA1 hash:	0f771355825d4e2ce0adbbc109e63b2c6d2a9e6b
MD5 hash:	21f1938dddf5c9343a8296febafc9510
humanhash:	paris-fix-oscar-carolina
File name:	允许注销@111.180.195.137.exe
Download:	download sample
Signature	Blackmoon Create hunting rule
File size:	856'576 bytes
First seen:	2024-05-07 01:18:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ffb169cf03ac3d4750dd8e3783007a92 (5 x Blackmoon)
ssdeep	24576:TFYLJfZXhoXnH0WahXUvK3QyOOrTxW7+EmTRR3QpgGRLWv2Pxw:TSBTg3P2
TLSH	T139053A237221C0A3C1612FF957AA163838F847152D79A963AFD8AEA67CB4533CF3550D
TrID	38.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 20.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.6% (.SCR) Windows screen saver (13097/50/3) 6.9% (.EXE) Win64 Executable (generic) (10523/12/4)
File icon (PE):
dhash icon	ccaa33cacab3b2ec (15 x Blackmoon, 1 x Gh0stRAT)
Reporter	bobross_malware2
Tags:	Blackmoon exe

Intelligence

File Origin

# of uploads :

# of downloads :

299

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7.exe

Verdict:

Malicious activity

Analysis date:

2024-05-07 01:20:34 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/01a826da-edda-478c-a8ed-77954ad99ab6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Dropper.Tiggre-9845940-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Connection attempt

Sending an HTTP GET request

Verdict:

Malicious

Labled as:

Ransom.Cerber.Generic

Link:

https://www.hybrid-analysis.com/sample/d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7

Malware family:

XiaoBa

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/de7bdcb1-fd20-4e4c-8ddb-d28aa470fab8

Result

Threat name:

BlackMoon

Detection:

malicious

Classification:

rans

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1437159

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected BlackMoon Ransomware

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7/

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2024-05-06 17:22:19 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2y3v5x67ig7636dscp5xbwl77qguzchdz2yk4uq7ux5r2wv4nt3q._file

Verdict:

malicious

Result

Malware family:

blackmoon

Score:

10/10

Tags:

family:blackmoon banker persistence trojan

Link:

https://tria.ge/reports/240507-bpjb6sbh71/

Behaviour

Modifies Control Panel

Suspicious use of AdjustPrivilegeToken

Sets file execution options in registry

Blackmoon, KrBanker

Detect Blackmoon payload

Unpacked files

SH256 hash:

a8b191e27be3c026d5170f995f447f8d7da114faed86820b639434f836d0379c

MD5 hash:

bce4733c6eb5ebaec06cd23a28f059a1

SHA1 hash:

02dacfb3c952f1c94540505e292ad0d444504a51

Link:

https://www.unpac.me/results/64c388dc-7573-4702-9c81-150acb031bac/

SH256 hash:

97ea3d99cf21123bc1aec72f9ded6a51ac659830392adfefd424eb799ab0219e

MD5 hash:

8b3591965f623b219c0c528153746cab

SHA1 hash:

020961494fa0e08779b7aacf4422269935354f7d

Link:

https://www.unpac.me/results/64c388dc-7573-4702-9c81-150acb031bac/

SH256 hash:

11c46cb8f4208fd25c77cdc688204f3252b07b50c481c15454af745652d60784

MD5 hash:

01c05ffcec63e010eec4425c304ed371

SHA1 hash:

8d5ed0c3e4ed87f954d57be041e7ee366cd99350

Link:

https://www.unpac.me/results/64c388dc-7573-4702-9c81-150acb031bac/

SH256 hash:

d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7

MD5 hash:

21f1938dddf5c9343a8296febafc9510

SHA1 hash:

0f771355825d4e2ce0adbbc109e63b2c6d2a9e6b

Detections:

BlackmoonBanker

MALWARE_Win_BlackMoon

Link:

https://www.unpac.me/results/64c388dc-7573-4702-9c81-150acb031bac/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_BlackMoon Create hunting rule
Author:	ditekSHen
Description:	Detects executables using BlackMoon RunTime

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	Windows_Trojan_CobaltStrike_f0b627fc Create hunting rule
Description:	Rule for beacon reflective loader

Rule name:	Windows_Trojan_CobaltStrike_f0b627fc Create hunting rule
Author:	Elastic Security
Description:	Rule for beacon reflective loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Blackmoon

exe d6375edfdf41bfedf87213fb70d97ffc0d4c88e3ceb0ae521fa5fb1d5abc6cf7

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2840681/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high
CHECK_TRUST_INFO	Requires Elevated Execution (level:requireAdministrator)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CreateStreamOnHGlobal
DP_API	Uses DP API	CRYPT32.dll::CryptProtectData
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdipGetImageEncodersSize gdiplus.dll::GdipGetImageEncoders gdiplus.dll::GdipDeleteGraphics gdiplus.dll::GdipFillRectangle gdiplus.dll::GdipDeleteBrush
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.DLL::CreateProcessA KERNEL32.DLL::CloseHandle WINHTTP.dll::WinHttpCloseHandle KERNEL32.DLL::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA KERNEL32.DLL::GetStartupInfoA KERNEL32.DLL::GetCommandLineA KERNEL32.DLL::GetCommandLineW
WIN_BASE_IO_API	Can Create Files	KERNEL32.DLL::CreateDirectoryA KERNEL32.DLL::CreateDirectoryW KERNEL32.DLL::CreateFileA KERNEL32.DLL::DeleteFileA KERNEL32.DLL::MoveFileA SHLWAPI.dll::PathRemoveFileSpecW
WIN_HTTP_API	Uses HTTP services	WINHTTP.dll::WinHttpAddRequestHeaders WINHTTP.dll::WinHttpConnect WINHTTP.dll::WinHttpCrackUrl WINHTTP.dll::WinHttpOpenRequest WINHTTP.dll::WinHttpOpen WINHTTP.dll::WinHttpQueryDataAvailable
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExA ADVAPI32.dll::RegDeleteKeyA ADVAPI32.dll::RegOpenKeyA ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegQueryValueExA ADVAPI32.dll::RegSetValueExA
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::ControlService ADVAPI32.dll::CreateServiceA ADVAPI32.dll::OpenSCManagerA ADVAPI32.dll::OpenServiceA ADVAPI32.dll::StartServiceA
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuW USER32.dll::CreateMenu USER32.dll::FindWindowExA USER32.dll::FindWindowExW USER32.dll::PeekMessageA USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample