MALICIOUS — 1210b5e35c7e27d947f067ef3fb66b38c2112ac6f9756351a1d358c9f468a788

MALICIOUS — 1210b5e35c7e27d947f067ef3fb66b38c2112ac6f9756351a1d358c9f468a788 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the BlackMoon family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 1210b5e35c7e27d947f067ef3fb66b38c2112ac6f9756351a1d358c9f468a788
SHA-1: a805d35c6d4fecf41020b9fee2dd8bb450f4ad09
MD5: 3b50b245e336e15a8a35083a4342a079
imphash: 9dacd5fc505421be83fd9ef325d44b59
ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm52:0cdpeeBSHHMHLf9RyIEQ5KXZb
TLSH: T1213B1B6796A3A4C9C93470AF3F4E73917400BDF00653798625ACE28FBDA758B46834C6
Submitted as: 1210b5e35c7e27d947f067ef3fb66b38c2112ac6f9756351a1d358c9f468a788
File type: pe · Size: 102083 bytes
Verdict: malicious (96/100) · Family: BlackMoon

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS 2.01-2.12
Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn
Microsoft Defender: Trojan:Win32/Blackmoon!rfn
Emsisoft (Emergency Kit): Adware.GenericKD.61151796
Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 96/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
Contacted 34 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:MPRESS 2.01-2.12 (rule DIE:MPRESS 2.01-2.12) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS 2.01-2.12 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

662 behavior events · 1 ATT&CK techniques · 22 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10138/files/c8f6aac731912e88f59dbcdd8b62b2a0e6e01de1430536e65b0fa726b0381377 - c8f6aac731912e88f59dbcdd8b62b2a0e6e01de1430536e65b0fa726b0381377
/opt/CAPEv2/storage/analyses/10138/files/b77fb2b2c0c8f238e932a2c5ae0a5255a07fc5452c0aefaa8be8dfbcffd24974 - b77fb2b2c0c8f238e932a2c5ae0a5255a07fc5452c0aefaa8be8dfbcffd24974
/opt/CAPEv2/storage/analyses/10138/files/762bd145c8959970851111ff82e40071cbf0345f9b9364ac2be82cd9caa9918d - 762bd145c8959970851111ff82e40071cbf0345f9b9364ac2be82cd9caa9918d
/opt/CAPEv2/storage/analyses/10138/files/5a180968607ce1ea2991d114bba123eb81c41dfaa2e120aef1f17473ab810b29 - 5a180968607ce1ea2991d114bba123eb81c41dfaa2e120aef1f17473ab810b29
/opt/CAPEv2/storage/analyses/10138/files/b85276445fc43b3afc0aba7d778d1b57a0312e333a7d7cc16934ae07e8d10687 - b85276445fc43b3afc0aba7d778d1b57a0312e333a7d7cc16934ae07e8d10687
/opt/CAPEv2/storage/analyses/10138/files/aaee695d3d7eefa54db45f98a747722bcf54b49879ea855b53dfa666797d3e69 - aaee695d3d7eefa54db45f98a747722bcf54b49879ea855b53dfa666797d3e69
/opt/CAPEv2/storage/analyses/10138/files/4837de1fd8cb9655e9a6c5e4897ff6605f5bea39625cddf616ee3c172d94715a - 4837de1fd8cb9655e9a6c5e4897ff6605f5bea39625cddf616ee3c172d94715a
/opt/CAPEv2/storage/analyses/10138/files/bf0d0582b8a5f41227559dc61c5ca66058eeb5a6109a1dae4a7fd8c4a208c832 - bf0d0582b8a5f41227559dc61c5ca66058eeb5a6109a1dae4a7fd8c4a208c832
/opt/CAPEv2/storage/analyses/10138/files/15642fadb045fa387df82955adad559f4eca2827516153171404513c12e3e2ab - 15642fadb045fa387df82955adad559f4eca2827516153171404513c12e3e2ab
/opt/CAPEv2/storage/analyses/10138/files/5caa48da0ee1fcf91fa05b52fcaade3a00315ef23331321a4ae23329e8eece86 - 5caa48da0ee1fcf91fa05b52fcaade3a00315ef23331321a4ae23329e8eece86
/opt/CAPEv2/storage/analyses/10138/files/7cf5e26ed87469e6f0730a9a51e5f72aacfe09d8003029cbc549a534915efe71 - 7cf5e26ed87469e6f0730a9a51e5f72aacfe09d8003029cbc549a534915efe71
/opt/CAPEv2/storage/analyses/10138/files/3528dffeda19380feca1dd1c3fd4fdfe7d00ce725004d3f074a87454f6b36567 - 3528dffeda19380feca1dd1c3fd4fdfe7d00ce725004d3f074a87454f6b36567
/opt/CAPEv2/storage/analyses/10138/files/38ef32dccb27641cefd3474a6d27f3db1f6fa9621ecbd6f23070db09023ee3f9 - 38ef32dccb27641cefd3474a6d27f3db1f6fa9621ecbd6f23070db09023ee3f9
/opt/CAPEv2/storage/analyses/10138/files/7e82f2392ceee54f5528f6cb59011a9a3b3228934b7f764d849a47d90c01588a - 7e82f2392ceee54f5528f6cb59011a9a3b3228934b7f764d849a47d90c01588a
/opt/CAPEv2/storage/analyses/10138/files/a5482ee32c934750e2c5b86d95131241809a8993c4c63cfcbba7d193f1f0e250 - a5482ee32c934750e2c5b86d95131241809a8993c4c63cfcbba7d193f1f0e250

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786443487&P2=404&P3=2&P4=Pu93je70sxYJPxn%2faGRlujLyjRjoyQjZ3%2famUnXMB5ypCdIOVt8CIKvRSqWLzD%2fBUENMu1if5BYFuj47Tr%2bokg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786443585&P2=404&P3=2&P4=QdCMSperbsJgFlALuIz%2ff99Uhq2%2f%2bm%2bIxII4wUtYiTO7lemSEJ%2bhbN5v3OQLUb8A20DP0cNgFtjtgIPtspw5uQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.72.131
52.230.59.222
4.230.171.124
20.42.179.204
74.178.76.128
135.232.92.97
4.150.223.102
20.89.1.8
135.234.160.246
92.223.78.30
52.110.12.14
52.110.12.10
203.26.79.13
57.155.101.212
172.215.188.225
52.123.252.229
20.165.94.46
72.145.35.102
52.148.114.188
52.110.12.38
52.110.12.52

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report