MALICIOUS — 5172b9c39fc73ae17dc9c7b278f5bc6939d3b04518fde21959b4216e287ca36f

MALICIOUS — 5172b9c39fc73ae17dc9c7b278f5bc6939d3b04518fde21959b4216e287ca36f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the BlackMoon family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5172b9c39fc73ae17dc9c7b278f5bc6939d3b04518fde21959b4216e287ca36f
SHA-1: 0f64d369c5612d844a71f33a0e4f35fc3425b926
MD5: 4b9e677a7277e7c8401030600515754a
imphash: 9dacd5fc505421be83fd9ef325d44b59
ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm5w:0cdpeeBSHHMHLf9RyIEQ5KXZv
TLSH: T1D83B1B6796A3A4C9C93470AF3F4E73917400BDF00653798625ACE28FBDA758B46834C6
Submitted as: 5172b9c39fc73ae17dc9c7b278f5bc6939d3b04518fde21959b4216e287ca36f
File type: pe · Size: 102142 bytes
Verdict: malicious (100/100) · Family: BlackMoon

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS 2.01-2.12
Microsoft Defender: Trojan:Win32/Blackmoon!rfn
Emsisoft (Emergency Kit): Adware.GenericKD.61151796
Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97
Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Blackmoon!rfn (rule Trojan:Win32/Blackmoon!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Adware.GenericKD.61151796 (rule Adware.GenericKD.61151796) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FPCQ!BA60F51D4D97 (rule Trojan-FPCQ!BA60F51D4D97) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Dinwod.acqn (rule Trojan-Dropper.Win32.Dinwod.acqn) - engine signal, weight 0.55, confidence 0.85
Contacted 36 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:MPRESS 2.01-2.12 (rule DIE:MPRESS 2.01-2.12) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS 2.01-2.12 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

726 behavior events · 1 ATT&CK techniques · 23 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10199/files/35f1a7b807f634ffa9ea0f6107099ade7d51d51eb90ad2f4f14322c82c05603c - 35f1a7b807f634ffa9ea0f6107099ade7d51d51eb90ad2f4f14322c82c05603c
/opt/CAPEv2/storage/analyses/10199/files/f003c05dbb4f72d43431de37b27ebb07cee44e06cdb9dcb9d0cbc86b16032cb5 - f003c05dbb4f72d43431de37b27ebb07cee44e06cdb9dcb9d0cbc86b16032cb5
/opt/CAPEv2/storage/analyses/10199/files/6963d60c81658f487b7ab71c9f2acabb866422a1939bd648006f9f2fd568b7cd - 6963d60c81658f487b7ab71c9f2acabb866422a1939bd648006f9f2fd568b7cd
/opt/CAPEv2/storage/analyses/10199/files/7417e2204c82a32dfa62aade940abbf721b60fbe305d0bae4d0f08bd23bf6e00 - 7417e2204c82a32dfa62aade940abbf721b60fbe305d0bae4d0f08bd23bf6e00
/opt/CAPEv2/storage/analyses/10199/files/9371679fe0d56280364c9e1b3fe443fa6c1f92394d0e40ecfec75c701208f66e - 9371679fe0d56280364c9e1b3fe443fa6c1f92394d0e40ecfec75c701208f66e
/opt/CAPEv2/storage/analyses/10199/files/8e39d752cf483883302eaaa2af14bb09af0c66e751a5ed146796a521c2b48e45 - 8e39d752cf483883302eaaa2af14bb09af0c66e751a5ed146796a521c2b48e45
/opt/CAPEv2/storage/analyses/10199/files/5a208216808caf32bc9646f4c8dab340d935f9431bd6bfa08f70ac552b8bcfa7 - 5a208216808caf32bc9646f4c8dab340d935f9431bd6bfa08f70ac552b8bcfa7
/opt/CAPEv2/storage/analyses/10199/files/02ba8f1c5107aef7b71c15d6931c50b49a02366b5e68e833eb7bfe0ff7f5a6aa - 02ba8f1c5107aef7b71c15d6931c50b49a02366b5e68e833eb7bfe0ff7f5a6aa
/opt/CAPEv2/storage/analyses/10199/files/ab215f63a3158f02c88c6c9f79c155aca31cf85663ace0a507fc3711890ca6c6 - ab215f63a3158f02c88c6c9f79c155aca31cf85663ace0a507fc3711890ca6c6
/opt/CAPEv2/storage/analyses/10199/files/bc46e9e428d8a386b0d3371d00e743ef97461a80289de47d2c600ff17bac71b2 - bc46e9e428d8a386b0d3371d00e743ef97461a80289de47d2c600ff17bac71b2
/opt/CAPEv2/storage/analyses/10199/files/f39805fd4d1da717c3c6cb44c62bfb8ca1f8bca147330c335e8c15b5531b861e - f39805fd4d1da717c3c6cb44c62bfb8ca1f8bca147330c335e8c15b5531b861e
/opt/CAPEv2/storage/analyses/10199/files/4aa5d7d77f513eda06181f8375e4e7217f8aeea980430e528601837b59fd3945 - 4aa5d7d77f513eda06181f8375e4e7217f8aeea980430e528601837b59fd3945
/opt/CAPEv2/storage/analyses/10199/files/a423b66acaf8ae9b1dcaf5e1119db13be81a66c59a3fae658f2ad39ddf6f2d4f - a423b66acaf8ae9b1dcaf5e1119db13be81a66c59a3fae658f2ad39ddf6f2d4f
/opt/CAPEv2/storage/analyses/10199/files/ac0a1a3388bcd4aeb9ad4fd10e127a272698d41e202b9d501cc0c118251b7cf5 - ac0a1a3388bcd4aeb9ad4fd10e127a272698d41e202b9d501cc0c118251b7cf5
/opt/CAPEv2/storage/analyses/10199/files/d70552c81696fada699e7e2342637af834e6a8f82a847d192232a4601e477d9d - d70552c81696fada699e7e2342637af834e6a8f82a847d192232a4601e477d9d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786445739&P2=404&P3=2&P4=Yuyj%2bVLa1BEVk5cWMdpNR9OOFT8Nb8RZKq7W2Xx1ojrli3R%2fCRmuWygZ6aPiYdtS3Yk7GAnztBcjtdcGlDo%2bPA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786445750&P2=404&P3=2&P4=EdBWh59RzE4Q%2fC4U4q3WqsfWfdLa%2bvScow5dTz20nNJ1pVlIhhYmLkUVsdo34qGcs573%2bGmSUJf7HFuR3GSi3A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.18
52.123.252.218
57.155.101.212
4.230.171.124
52.230.60.54
4.247.188.233
74.178.240.61
20.42.65.94
74.178.240.51
52.123.252.224
20.165.94.46
203.26.79.13
135.233.45.223
52.110.12.22
52.110.12.3
72.145.35.105
52.148.114.188
57.154.63.210
52.110.12.5
52.110.12.1

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report