MALICIOUS — bdc36e1a5b19c27e88e8b7514211a10d69677679ff624bbf8e845f28d5e6a6da

MALICIOUS — bdc36e1a5b19c27e88e8b7514211a10d69677679ff624bbf8e845f28d5e6a6da is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Blackmoon family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: bdc36e1a5b19c27e88e8b7514211a10d69677679ff624bbf8e845f28d5e6a6da
SHA-1: f772385df25f215df3db30fee1aff1c6b992cb89
MD5: d49ff049892b822b16b498e057394279
imphash: bac6430e133e2025fbcf939120287a47
ssdeep: 98304:JxVsBnYt4TAzjcYhlNBGxqVNzy2P+XIujGCuewGMJwsw5TOVguxVsBnYt4TAzjc:hT4T2cGlNzyWYRjGCuJATOVgMT4T2cG
TLSH: T1F3643399DA69A4A6E5702B3E3B42184FD705E46DB70E3E22121C41E1E132B4F71EE0D7
Submitted as: bdc36e1a5b19c27e88e8b7514211a10d69677679ff624bbf8e845f28d5e6a6da
File type: pe · Size: 5163072 bytes
Verdict: malicious (100/100) · Family: Blackmoon

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Dropper.Tiggre-9845940-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Blackmoon!rfn
Kaspersky (KVRT): HEUR:Trojan.Win32.Miner.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Dropper.Tiggre-9845940-0 (rule Win.Dropper.Tiggre-9845940-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Blackmoon!rfn (rule Trojan:Win32/Blackmoon!rfn) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Miner.gen (rule HEUR:Trojan.Win32.Miner.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 6 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hollowing in dllhost.exe (pid 4760) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

791 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Windows\Fonts\frnecm\fudojaq.exe - 9d99f5c5fdcd9b116e2d9a496616f732417bc50c2842695aa9ad817ff9234963

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

fu.pixxvv.club
hutao.halorick.club
hutao.lulululu.shop
hutao.oppomm.club
cfg.bigdocker.shop
stfu.pixxvv.club
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
stfu1.pixxvv.club

Embedded IP addresses

4.150.223.104
135.232.92.137
40.84.85.40
4.230.171.124
4.144.132.223
135.232.92.97
135.234.160.244
92.223.78.30
4.150.223.107
20.42.65.89
52.148.114.188
52.123.252.239
72.145.35.99
52.110.12.26
52.110.12.32

File paths

C:\u
J:\/J.
F:\U
c:\lib\

More Blackmoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report