MALICIOUS — ae39c2b13ff43df8ab95323bef8e3dd4072019f4b2b6cc5c15c11fa340178da9

MALICIOUS — ae39c2b13ff43df8ab95323bef8e3dd4072019f4b2b6cc5c15c11fa340178da9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the BlackMoon family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: ae39c2b13ff43df8ab95323bef8e3dd4072019f4b2b6cc5c15c11fa340178da9
SHA-1: 61d950130f9399898d038521b699215e6d0c7ce1
MD5: 5e8ede76cb8c281b9b04810fcfcd6520
imphash: 9dacd5fc505421be83fd9ef325d44b59
ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm5G:0cdpeeBSHHMHLf9RyIEQ5KXZ7
TLSH: T1A73B1B6796A3A4C9C93470AF3F4E73917400BDF00653798625ACE28FBDA758B46834C6
Submitted as: ae39c2b13ff43df8ab95323bef8e3dd4072019f4b2b6cc5c15c11fa340178da9
File type: pe · Size: 102361 bytes
Verdict: malicious (98/100) · Family: BlackMoon

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS 2.01-2.12
Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn
Microsoft Defender: Trojan:Win32/Blackmoon!rfn
Emsisoft (Emergency Kit): Adware.GenericKD.61151796
Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 38 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:MPRESS 2.01-2.12 (rule DIE:MPRESS 2.01-2.12) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS 2.01-2.12 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

702 behavior events · 1 ATT&CK techniques · 22 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10159/files/783eca6ef7a4a057234d3e5f98bac4f6b08a5dbc8e15d98f86bf517fda5b8ed4 - 783eca6ef7a4a057234d3e5f98bac4f6b08a5dbc8e15d98f86bf517fda5b8ed4
/opt/CAPEv2/storage/analyses/10159/files/d87f24c66c57275d9ce9aa5773cda4bd0dfbb049f95f77c9674e718ea0a1ea21 - d87f24c66c57275d9ce9aa5773cda4bd0dfbb049f95f77c9674e718ea0a1ea21
/opt/CAPEv2/storage/analyses/10159/files/fd04e0b7874d6e9c3c157e80c59deb8887ea30980bb20992ba83d57a76554113 - fd04e0b7874d6e9c3c157e80c59deb8887ea30980bb20992ba83d57a76554113
/opt/CAPEv2/storage/analyses/10159/files/c6d440dc1e3177b599f52f1ed2bd4aaf43c71c65f5c901cbfe0e8d4b253ba7f2 - c6d440dc1e3177b599f52f1ed2bd4aaf43c71c65f5c901cbfe0e8d4b253ba7f2
/opt/CAPEv2/storage/analyses/10159/files/f2d4678772ad59e178a37c7d711dbd2005dc4d9d1f2a5675b7c00af0262a5799 - f2d4678772ad59e178a37c7d711dbd2005dc4d9d1f2a5675b7c00af0262a5799
/opt/CAPEv2/storage/analyses/10159/files/68c522301cab6de9be7319866d35a141ab7711b700000ddd16f4d1a6aa347702 - 68c522301cab6de9be7319866d35a141ab7711b700000ddd16f4d1a6aa347702
/opt/CAPEv2/storage/analyses/10159/files/8df4c54e466fec026b19bc47405542d6d4d31163868be3e0c3d974bde3b8c50d - 8df4c54e466fec026b19bc47405542d6d4d31163868be3e0c3d974bde3b8c50d
/opt/CAPEv2/storage/analyses/10159/files/b0ad70998677968508cf9af331e0441519afcc700c1e551bfe52a69322a68882 - b0ad70998677968508cf9af331e0441519afcc700c1e551bfe52a69322a68882
/opt/CAPEv2/storage/analyses/10159/files/9e50aa5c05bf71b94581aab01212a7298fdfbafad83c9bc816a85ff15a9859d6 - 9e50aa5c05bf71b94581aab01212a7298fdfbafad83c9bc816a85ff15a9859d6
/opt/CAPEv2/storage/analyses/10159/files/88dfa6a145d45ad909f5fae7948a94958ba3b131adacc3fd0798bf9d6eaacbc4 - 88dfa6a145d45ad909f5fae7948a94958ba3b131adacc3fd0798bf9d6eaacbc4
/opt/CAPEv2/storage/analyses/10159/files/24d4fa790a8f0a5145a5dccd1a183d623160ff452a49ddf46502e99fa1c80ade - 24d4fa790a8f0a5145a5dccd1a183d623160ff452a49ddf46502e99fa1c80ade
/opt/CAPEv2/storage/analyses/10159/files/7a7125fd5296f82e9dd2f44c48a53cddb8ce2bc5bd0518e31de90b7c6ea830eb - 7a7125fd5296f82e9dd2f44c48a53cddb8ce2bc5bd0518e31de90b7c6ea830eb
/opt/CAPEv2/storage/analyses/10159/files/2b376a008091a1dd382aecfe39358cbb18b4a08704bbad91ce2e935e1bccb877 - 2b376a008091a1dd382aecfe39358cbb18b4a08704bbad91ce2e935e1bccb877
/opt/CAPEv2/storage/analyses/10159/files/24ab1a758167bb6dd8e3025a51dc8d22546d3b3de491220497ff110b4865cd46 - 24ab1a758167bb6dd8e3025a51dc8d22546d3b3de491220497ff110b4865cd46
/opt/CAPEv2/storage/analyses/10159/files/7b5cfb77d76486733cecdc19be3ddc0faced3136d59c2faf6dd6a1548a034538 - 7b5cfb77d76486733cecdc19be3ddc0faced3136d59c2faf6dd6a1548a034538

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786444270&P2=404&P3=2&P4=YA9qi943%2bcz0KUQ0u2u2%2b2vYe4xAsICC%2fKnQq2fd0FZF56jCNsb5%2b2nvj1ncdXLzHNAMsUzoBbdk449KYCdyag%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786444379&P2=404&P3=2&P4=Y%2f4gzNkLrKeSumY6Qa4jK1h7lXD4mOt46QOvFIoBzPCiTNwJgHB5tFUYjqr5HNnHTjrqUDX4qh9WZTpd066Qxg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.89
52.110.12.18
57.155.104.224
4.230.171.124
20.247.184.142
52.110.12.51
20.165.94.63
20.184.175.7
74.178.240.51
135.233.45.222
203.26.79.13
92.223.78.30
135.232.92.34
20.184.175.6
4.150.223.101
72.145.35.115
52.148.114.188
57.155.101.212
74.179.71.159
52.110.12.8
52.110.12.38

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report