MALICIOUS — 87e16c2c1856794acf38bfb1fec5ae43f2b01b4354b5019ed0fe8b1b5f7445f7

MALICIOUS — 87e16c2c1856794acf38bfb1fec5ae43f2b01b4354b5019ed0fe8b1b5f7445f7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the BlackMoon family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 87e16c2c1856794acf38bfb1fec5ae43f2b01b4354b5019ed0fe8b1b5f7445f7
SHA-1: 9116169148edb58168f29b6092231f7b7d0deac4
MD5: 62da34fa66567265ab603d3810209dd9
imphash: 9dacd5fc505421be83fd9ef325d44b59
ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm50:0cdpeeBSHHMHLf9RyIEQ5KXZT
TLSH: T1913B1B6796A3A4C9C93470AF3F4E73917400BDF00653798625ACE28FBDA758B46834C6
Submitted as: 87e16c2c1856794acf38bfb1fec5ae43f2b01b4354b5019ed0fe8b1b5f7445f7
File type: pe · Size: 102064 bytes
Verdict: malicious (100/100) · Family: BlackMoon

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS 2.01-2.12
Microsoft Defender: Trojan:Win32/Blackmoon!rfn
Emsisoft (Emergency Kit): Adware.GenericKD.61151796
Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97
Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Blackmoon!rfn (rule Trojan:Win32/Blackmoon!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Adware.GenericKD.61151796 (rule Adware.GenericKD.61151796) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FPCQ!BA60F51D4D97 (rule Trojan-FPCQ!BA60F51D4D97) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Dinwod.acqn (rule Trojan-Dropper.Win32.Dinwod.acqn) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 47 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:MPRESS 2.01-2.12 (rule DIE:MPRESS 2.01-2.12) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS 2.01-2.12 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

670 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10147/files/2ae9b2225ae73d199c91713c2d24aea25ddebf5bd2f535bf4c38918a38b401cb - 2ae9b2225ae73d199c91713c2d24aea25ddebf5bd2f535bf4c38918a38b401cb
/opt/CAPEv2/storage/analyses/10147/files/3059c8f39d0100dadddcadbabcb0a3209269a413cb1faac4adc4f31cb377f989 - 3059c8f39d0100dadddcadbabcb0a3209269a413cb1faac4adc4f31cb377f989
/opt/CAPEv2/storage/analyses/10147/files/8281c764b68e25feebfc1d2f0bebd251b0d3e1482a07221a52c235a227d5bb3c - 8281c764b68e25feebfc1d2f0bebd251b0d3e1482a07221a52c235a227d5bb3c
/opt/CAPEv2/storage/analyses/10147/files/03dc3e517451a7d21ae68b3a66ad240017589be6e0fd488103016f9da3ad7555 - 03dc3e517451a7d21ae68b3a66ad240017589be6e0fd488103016f9da3ad7555
/opt/CAPEv2/storage/analyses/10147/files/74c131c6b0470dc819a8faa5958c7c48dc177200dcee086f3c619eb8e32b833b - 74c131c6b0470dc819a8faa5958c7c48dc177200dcee086f3c619eb8e32b833b
/opt/CAPEv2/storage/analyses/10147/files/9bbc645ac58e8ac19f9e462143a87824d4287958af4dd92941b44ec6e60f7fd2 - 9bbc645ac58e8ac19f9e462143a87824d4287958af4dd92941b44ec6e60f7fd2
/opt/CAPEv2/storage/analyses/10147/files/b3fc27ca877dea255f8ce44a63adc7f38e4969217f22c381e2acd36a07829a70 - b3fc27ca877dea255f8ce44a63adc7f38e4969217f22c381e2acd36a07829a70
/opt/CAPEv2/storage/analyses/10147/files/ffda4993aece37b93c4ce44443b7bc0ecaf64c82c52eb320b2fddb4d6f641ab2 - ffda4993aece37b93c4ce44443b7bc0ecaf64c82c52eb320b2fddb4d6f641ab2
/opt/CAPEv2/storage/analyses/10147/files/d425e16afcb59c1dbd1450f3dcb6cd8929cee5274f948ef8c773d9aed3a5d692 - d425e16afcb59c1dbd1450f3dcb6cd8929cee5274f948ef8c773d9aed3a5d692
/opt/CAPEv2/storage/analyses/10147/files/2ad592e6e1915397814e5aca7a648635c49b2c4a3657aea521f988de333f1dd4 - 2ad592e6e1915397814e5aca7a648635c49b2c4a3657aea521f988de333f1dd4
/opt/CAPEv2/storage/analyses/10147/files/cdeb691f55857264fb92afe9680c10031be93a844bc5bd67c896c00b7bde95bd - cdeb691f55857264fb92afe9680c10031be93a844bc5bd67c896c00b7bde95bd
/opt/CAPEv2/storage/analyses/10147/files/38f16f5ff8e781882004b3a375ebd7c0f53654023f3c5fc51ed36811c28e0676 - 38f16f5ff8e781882004b3a375ebd7c0f53654023f3c5fc51ed36811c28e0676
/opt/CAPEv2/storage/analyses/10147/files/fe6b47721c87a1db1e1e9d2135c9e0848c16e68c8a38eebd651c5ca423759577 - fe6b47721c87a1db1e1e9d2135c9e0848c16e68c8a38eebd651c5ca423759577
/opt/CAPEv2/storage/analyses/10147/files/59d6807040549125f7080edaf621cf96a79fe0f3b7cf4ca85bdd7d488332d070 - 59d6807040549125f7080edaf621cf96a79fe0f3b7cf4ca85bdd7d488332d070
/opt/CAPEv2/storage/analyses/10147/files/f62644bec6f625cd43a1de4bee540bf93866ac540187eb1b2a95781e3a83fa4b - f62644bec6f625cd43a1de4bee540bf93866ac540187eb1b2a95781e3a83fa4b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786443851&P2=404&P3=2&P4=QPgoLJELZqwBA9A50GyxIzJrx8C9IFn2pK7yks3ODkLqyJeZxE5Mn%2fMlrthF5urG1ng0BYYeZrcLt0ToR72fVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786443957&P2=404&P3=2&P4=efU8atKKGSlkbpgfmd%2fpWuMFCtQT4%2bR8vg7uQxmGdMXWx3lqURJmUWEdlJ59q7n3AUGCM9FtI7mVkUvVPxoZlw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

oneclient.sfx.ms

Embedded IP addresses

51.105.71.136
40.84.85.40
4.230.171.124
57.155.104.224
52.253.84.76
74.179.77.204
74.178.240.51
4.150.223.115
172.178.240.161
203.26.79.13
4.247.188.233
20.42.179.204
20.42.73.27
51.104.15.252
52.110.12.53
74.178.232.29
52.148.114.188
72.153.5.137
20.184.175.21
57.155.101.212
20.42.73.28
4.247.188.224
52.168.117.175
40.84.97.4
40.79.163.154

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report