MALICIOUS — d68382cffa3950dde5fab473bc72686f9af30763b0b0e3443727c659eef33075

MALICIOUS — d68382cffa3950dde5fab473bc72686f9af30763b0b0e3443727c659eef33075 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the BlackMoon family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d68382cffa3950dde5fab473bc72686f9af30763b0b0e3443727c659eef33075
SHA-1: b029a7ea3f5459b6f83ecd7d3553670bff074bc0
MD5: b515e1595506b881e14da25f09a15b02
imphash: 9dacd5fc505421be83fd9ef325d44b59
ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm5W:0cdpeeBSHHMHLf9RyIEQ5KXZ5
TLSH: T1953B1B6796A3A4C9C93470AF3F4E73917400BDF00653798625ACE28FBDA758B46834C6
Submitted as: d68382cffa3950dde5fab473bc72686f9af30763b0b0e3443727c659eef33075
File type: pe · Size: 102246 bytes
Verdict: malicious (100/100) · Family: BlackMoon

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS 2.01-2.12
Microsoft Defender: Trojan:Win32/Blackmoon!rfn
Emsisoft (Emergency Kit): Adware.GenericKD.61151796
Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97
Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Blackmoon!rfn (rule Trojan:Win32/Blackmoon!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Adware.GenericKD.61151796 (rule Adware.GenericKD.61151796) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FPCQ!BA60F51D4D97 (rule Trojan-FPCQ!BA60F51D4D97) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Dinwod.acqn (rule Trojan-Dropper.Win32.Dinwod.acqn) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 34 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:MPRESS 2.01-2.12 (rule DIE:MPRESS 2.01-2.12) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS 2.01-2.12 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

727 behavior events · 1 ATT&CK techniques · 24 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10205/files/7ceed165deb999735d3ea385ef587a0f2e58d3afb863c926410e9ebcc91ffcf4 - 7ceed165deb999735d3ea385ef587a0f2e58d3afb863c926410e9ebcc91ffcf4
/opt/CAPEv2/storage/analyses/10205/files/d8eaca7409a791dbe63e8def340e0ecbbd0c7fa65b65031635506e6ed7171506 - d8eaca7409a791dbe63e8def340e0ecbbd0c7fa65b65031635506e6ed7171506
/opt/CAPEv2/storage/analyses/10205/files/26356b21587f0940907f9b6f2be8a7a12cfa0b2516a76f71471b32b6a6148a3f - 26356b21587f0940907f9b6f2be8a7a12cfa0b2516a76f71471b32b6a6148a3f
/opt/CAPEv2/storage/analyses/10205/files/0c2f61f6ab44c6fe8bc79b87a0a9b9861f350f1776b163907a316432ee1ddf4b - 0c2f61f6ab44c6fe8bc79b87a0a9b9861f350f1776b163907a316432ee1ddf4b
/opt/CAPEv2/storage/analyses/10205/files/8c5d126f127260870dd0a24f5418ee392acf8885064032aecbdda1e68b0c73c7 - 8c5d126f127260870dd0a24f5418ee392acf8885064032aecbdda1e68b0c73c7
/opt/CAPEv2/storage/analyses/10205/files/99efbcd1d9af9ac9055f6815bc0d045145a70894535093a1d7114ec826b83962 - 99efbcd1d9af9ac9055f6815bc0d045145a70894535093a1d7114ec826b83962
/opt/CAPEv2/storage/analyses/10205/files/cac7531d5611f14dddd5942b2ddece69b7fab412c0fa3d4b9b14e15442394ef1 - cac7531d5611f14dddd5942b2ddece69b7fab412c0fa3d4b9b14e15442394ef1
/opt/CAPEv2/storage/analyses/10205/files/a80cb1c5d83c7c0a933f03356fc9bd0032d56a111ce32364f352f5f61016387e - a80cb1c5d83c7c0a933f03356fc9bd0032d56a111ce32364f352f5f61016387e
/opt/CAPEv2/storage/analyses/10205/files/7396990ea09990a4c1bf1d0c533823131bbe5cddb875ca28750b9a3287916b0d - 7396990ea09990a4c1bf1d0c533823131bbe5cddb875ca28750b9a3287916b0d
/opt/CAPEv2/storage/analyses/10205/files/3e8bd37b2f813698ac2d400a572db2e9c3c471b33c86ccf8d24ccc5be114a510 - 3e8bd37b2f813698ac2d400a572db2e9c3c471b33c86ccf8d24ccc5be114a510
/opt/CAPEv2/storage/analyses/10205/files/1d8fd65162865eb7bda5fa804e4d41ee1cc95a2c1b97959cd6f959a7df6c1cc4 - 1d8fd65162865eb7bda5fa804e4d41ee1cc95a2c1b97959cd6f959a7df6c1cc4
/opt/CAPEv2/storage/analyses/10205/files/98fc9f52fea22d067b0298a64c9fcda17a08af4963bfe46d07424d5e207e581a - 98fc9f52fea22d067b0298a64c9fcda17a08af4963bfe46d07424d5e207e581a
/opt/CAPEv2/storage/analyses/10205/files/3683b1f9f907bcf0434e8f788c4642cf44d0a72c5e77b06010052ad0a9223f95 - 3683b1f9f907bcf0434e8f788c4642cf44d0a72c5e77b06010052ad0a9223f95
/opt/CAPEv2/storage/analyses/10205/files/b2660bb4ca1f23e7835acdee9937e5176ba14d2a3ca87e23bd6dd81efe6552d7 - b2660bb4ca1f23e7835acdee9937e5176ba14d2a3ca87e23bd6dd81efe6552d7
/opt/CAPEv2/storage/analyses/10205/files/3ea8db557b879674b13ca18a199cf5f5a8a17b076763f3ecf35f1f2e10fcc5bc - 3ea8db557b879674b13ca18a199cf5f5a8a17b076763f3ecf35f1f2e10fcc5bc

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786446028&P2=404&P3=2&P4=J3tmdA14vWuwpA0eEvmmeBil7AtD5%2bSdOoCCPxLaNodsyS3IU463X4PABL9VbT7vh3EXyYaoCGEsBUqcd%2bjF%2bQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786446127&P2=404&P3=2&P4=bVDFmx5qPImj8XjJfbAnW7NiIODo9Kc3iG2lW%2fPmc339orwXzCQZXLNC9DYxJwao5f5mtmRv7ZsO890RQKINYQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.115
20.42.179.204
4.230.171.124
52.253.84.76
135.233.95.144
74.178.240.51
20.184.175.16
4.150.223.102
172.178.240.163
203.26.79.13
52.168.117.171
85.210.193.152
20.165.94.46
52.110.12.38
52.110.12.8
72.145.35.104
52.148.114.188
92.223.78.30
52.110.12.33
52.110.12.51

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report