MALICIOUS — 4bf1c2c803ea1e8d953273e9fd19e3d79f59d2b7f6871ca5c7042e81a2b69d23

MALICIOUS — 4bf1c2c803ea1e8d953273e9fd19e3d79f59d2b7f6871ca5c7042e81a2b69d23 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the BlackMoon family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4bf1c2c803ea1e8d953273e9fd19e3d79f59d2b7f6871ca5c7042e81a2b69d23
SHA-1: d532ff9c479cb419bf97d4825e80b95c4233b1d5
MD5: e735a868980f0bca7b55303523323797
imphash: 9dacd5fc505421be83fd9ef325d44b59
ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm5u:0cdpeeBSHHMHLf9RyIEQ5KXZ9
TLSH: T1AF3B1B6796A3A4C9C93470AF3F4E73917400BDF00653798625ACE28FBDA758B46834C6
Submitted as: 4bf1c2c803ea1e8d953273e9fd19e3d79f59d2b7f6871ca5c7042e81a2b69d23
File type: pe · Size: 102218 bytes
Verdict: malicious (96/100) · Family: BlackMoon

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS 2.01-2.12
Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn
Microsoft Defender: Trojan:Win32/Blackmoon!rfn
Emsisoft (Emergency Kit): Adware.GenericKD.61151796
Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 96/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
Contacted 47 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:MPRESS 2.01-2.12 (rule DIE:MPRESS 2.01-2.12) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS 2.01-2.12 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

714 behavior events · 1 ATT&CK techniques · 23 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10423/files/e5fae756757b00ed250a31cd71ddcebf6260962384f885ca994ae66899859b49 - e5fae756757b00ed250a31cd71ddcebf6260962384f885ca994ae66899859b49
/opt/CAPEv2/storage/analyses/10423/files/97be6eba0f49e37168d3fe13c824f1e73b4b5b557a037e6af8a97568697983bb - 97be6eba0f49e37168d3fe13c824f1e73b4b5b557a037e6af8a97568697983bb
/opt/CAPEv2/storage/analyses/10423/files/c148ee80ff3a1d15e3c8583c4832a8c9083a32046fa5d8efc5a63a3a1a3d6787 - c148ee80ff3a1d15e3c8583c4832a8c9083a32046fa5d8efc5a63a3a1a3d6787
/opt/CAPEv2/storage/analyses/10423/files/e71f7288e92172b994f78e07ff8c836c39b78a12648cefcc6501ed091a376153 - e71f7288e92172b994f78e07ff8c836c39b78a12648cefcc6501ed091a376153
/opt/CAPEv2/storage/analyses/10423/files/63f507f6b5a86c762f743112f27153081115e9de4ff71939c157d68141449d94 - 63f507f6b5a86c762f743112f27153081115e9de4ff71939c157d68141449d94
/opt/CAPEv2/storage/analyses/10423/files/54a3b029d5d93c833e2ddfaad89cd102590c6b9f0908a17420a441959db3f96f - 54a3b029d5d93c833e2ddfaad89cd102590c6b9f0908a17420a441959db3f96f
/opt/CAPEv2/storage/analyses/10423/files/e63d69676491152163a852ecdd6d963e2ba35d4210217dcd86c55ff7b6a63c90 - e63d69676491152163a852ecdd6d963e2ba35d4210217dcd86c55ff7b6a63c90
/opt/CAPEv2/storage/analyses/10423/files/89696e28e67ea7ce7ce55177fb164109e50219b60df287402a6833d89ca6ee8c - 89696e28e67ea7ce7ce55177fb164109e50219b60df287402a6833d89ca6ee8c
/opt/CAPEv2/storage/analyses/10423/files/5e4d98f5b5b7afef337950892f2ab82eeae4f99f8a1912ae69d429f7585db755 - 5e4d98f5b5b7afef337950892f2ab82eeae4f99f8a1912ae69d429f7585db755
/opt/CAPEv2/storage/analyses/10423/files/82f2ccc956665a4923fa1d97d1fa65f8337f037819b28159e9371904e3c2351c - 82f2ccc956665a4923fa1d97d1fa65f8337f037819b28159e9371904e3c2351c
/opt/CAPEv2/storage/analyses/10423/files/181716469e30e08bd65ca57700fc80c77c43b884abcf8865eeaaff7bfe08544d - 181716469e30e08bd65ca57700fc80c77c43b884abcf8865eeaaff7bfe08544d
/opt/CAPEv2/storage/analyses/10423/files/b5998e98f5d8606601101dab767b392934ad254bf08e386d280ec1ab65f5a49d - b5998e98f5d8606601101dab767b392934ad254bf08e386d280ec1ab65f5a49d
/opt/CAPEv2/storage/analyses/10423/files/2a5f19130dcd542c5b34ff48e3bc5b3b89d47c6062ca36a89a38339894b18c3e - 2a5f19130dcd542c5b34ff48e3bc5b3b89d47c6062ca36a89a38339894b18c3e
/opt/CAPEv2/storage/analyses/10423/files/41d73425a13d507ba3df65d0c7f8c67d74f6efd68706fd091ade4eb8dac9566c - 41d73425a13d507ba3df65d0c7f8c67d74f6efd68706fd091ade4eb8dac9566c
/opt/CAPEv2/storage/analyses/10423/files/85bb5af143519cf2f30845584ca1def4be58d294d2e08ad3058efae2950535d1 - 85bb5af143519cf2f30845584ca1def4be58d294d2e08ad3058efae2950535d1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786452822&P2=404&P3=2&P4=IXDyK5Id9E8a%2bSPn%2fwotsUivr9Pc%2b0qCy%2bdnJtL%2f0mUD69AupiAgTMp3QupcZBqgmov9Fq7UP7xLD5zjniaPhw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786452915&P2=404&P3=2&P4=h%2f%2bAS9O2VqH3iTCA0ft%2f4xFCuCgmrhfJS42iWQXFRN%2fange%2f8%2fw8K8LlFx%2bv4U05elagv%2bfMKDzZbHUyJSobUg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

oneclient.sfx.ms

Embedded IP addresses

20.42.73.28
48.211.4.16
52.123.252.218
4.230.171.124
4.144.132.114
172.215.188.225
74.178.240.61
135.232.92.97
4.150.223.102
135.234.160.246
20.184.175.19
20.42.65.94
203.26.79.13
52.110.12.14
135.232.92.34
52.110.12.16
72.154.7.97
92.223.78.30
52.148.114.188
4.150.223.101
13.89.179.15
40.84.85.40
40.84.97.4
172.215.188.232
52.123.252.219

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report