4p �U��3\�s1?uY�r��1�s�+��T3�3 Filc�"֞2�g,a��ϕ�� ��x�&Jv= X���A��J�;���b!Vp.��tx�t$�XI��6��*[ݠ�a�X�����n}�sz%�eM���Խ��(�R�/i2�sI�%��u���x�=�A�(�(kJF4�~q ��@��9ĸ�=�U��xٛ$`�s=��Dd��ZG`�n�]ƅm���9�Xmr����T�����Nfk�5CkIͼ1"��U���>ct��k�pԄ�o�|N��HZ�M�д����Lm�{�1�Dg��OPS-g���u��9V�u��h��-�5ƣ0��_�,��l���*��@=gzV���IJ��$�6��,�=��[e�cW�����1�'���HD��/�� fZ�~J��`٤���t��\��mN��!��T�9m�ྑ������h~:#��v���o�)��힛īIc�@��I�vM�������l�ƾ[�kH0��Vϕ�]9��V3B�ҕ�G?��[��& f�!x���7��*Kǖ�UT��Bξ:k��{Fe�����W�D���s���R�Y�r������|��B>�l�C`nj��oA���ك��:*����q��Mi!%�/��T��X�$F�����gv�R恳�C�U��1�.-/�(Y�1Ԣ�El;?Z��J!"HS�Z�|��ky$�IYLQ9�n�[�[�P���s}O�8J u<뎠 �hk|H8�I�i��ak�y� &����,�!���ZO����W��K����6,\6�*�`w%��;]�����>m��}ae�&��oʛtf�;`Zgo(�H__�Q&�PqK��CJ)+����M�O^RŶ�(;H�(�u�����w ?����`�B9:�v'VY��l�.8��\���iX��fG��Usj�T�EB%q��n�W���&��o|�BA���?w �y�����<�~�uMgb/G�v�I ����|�s�I5�W+�����)[��np��a?F&f��K�zh;r�=*�jr�e���4O�1Vf���~Lg� ��M��rvI�`1"4c���^��ٰ����L!��K��h�����,�澸��M��^�וO�A��(Pl[�� �~���5�s�\=��!X�5�:�&�]v{�j��j8)�a&�Zz��|�)��7�����n(&�05 �a��`�#���~��Û(E��9���������[ I�Ȁɱ#2�w�@��_W~Z=E�os�W�=u��`t����6���;����<�S��� �� �ӭ�(�z���D'�*� wƶ��V�wX���HN�3>��B�G��@����3�@���+^��%�(L��|��?G��`u�8c��1Tu�a#��Er�b(�X�� �u�bv� ?>��>|�м����/� �Χk7���he�!q���B�CQ�4e�_����h��o�"�7�_��es��U���Շ��p'�?P��� kԂ��h2gR���1�x�( �5��gB���F{E��Op��t�����������f�^�� (� l��-�T��t� {��s8w밐j{~�0����<�#Xe�9;I+PD ��?7o��r(Jˆ���ږ5I�P,�<���I=�������+�_$�wg���Kv>�>'Q�"��Rp�м� ;�"'��E� K��~��O�n,�h-���h���!���Y�u#�c���,�lT�F�EՓ�2[kM�~���8D�0�^<F'�k��I��E��D)��¿ �Exv�Q��ܤ��%�m���=�~o��l����S�"O&� M��Omz (��ϧ��+��n�o��ӋFP� �@:�G٧l �uv/�J+��UՕ����]õW��"/U��ɿ9J�i��VA�5$A����Fծ��j8f�gs��ü�{@:������N��S=����ڑ+�*"�)4�|b�2f���Gp����q�э;�0JFZ Ϳ�J�.� ��A�?H�Hp��*R��K��-i�1cD3h��o4X�~�� �� y�$9;֧c,�ݪ�<=��]����@?��g����g��l��nc��������@�WV�����rD�7�n���8���C��^=`)6/T~Q��@k��� apB�<�(\dV�/�L�5P��ׄ+TR�D�D�9 #�"���Y�,������Q4��sn�sҤ��a�s�=�e���K������ �|¾��*�;����d��5��[~�+�����e��'q�r �� �7��w5#�a?�<��쿧�äE��?���������B���@{ ���T�Y��R>�z��-`�D4v�K6�@-��í�|���s*�~� ��%/��XΘ�����`&M\� 5� ~����t�=%��S�{A�V�d�X9�E$XV,���ʉ;��ms�� Ņ����B��5���gy3��[ӔI0�������G�E��S���v r4�=��ҡ��t�˂�dE9���2D�ze��5k ���Tksd�)�y�_��R�q�hE0��5�_;\��eB�ZxR݂WWe%��1<8���&F��a���b���d ��X�?w��j]��t�ȵ?��2�}8m���A�P�4�@�q�B!�ƐD���tOf|l{�]�I �7�=�<� *��6밦pk������ůGb�X��/���W��NU-���~�0m���)?����"-�t:u3�a@HeW8eO�m�x�����O ѳ�� .��lU)�N�Q��Gp8�B�!�T�i����8��H����>��C"�.���ue�u���n1AC��2i-Ab�ћ��>M���[˧Q?P�| ��zA�j���O���1�3#E@?����D��w�`ʰvNQR{���>Ŏ�D�[\�$�Ws{ L0��;J��x�&��j��S��㔵�W��'�a�u��T�`����hi؝2��41��D�(^�c����Nr�D� ����y��]�<.n��ϙ�BHlƳ�\��Y�� U*���j$��}�w$zfDg ў���E.�
Behavioral task
behavioral1
Sample
Black Leecher v2.1.exe
Resource
win10v2004-20220901-en
General
-
Target
Black Leecher v2.1.rar
-
Size
5.5MB
-
MD5
39216e44a04a0c19807494dfdbbe5ca1
-
SHA1
6c02bf469154449e44f64071a2acdcce53ea576a
-
SHA256
4858761d5095b4b8e0022c0d872993ac1af4f486c78d913fdfe7f6db79e0ba41
-
SHA512
e3b2a138dfa4fd3b9c386cd172568252918378349418961bb3e06cdadb53204db489f8b59fceb7047afc3a1e1cbc0a1b47615ddc21488fdc4d9211c82dd8d8dd
-
SSDEEP
98304:aDyqStAp8u23TgM/zscoVAKUmmrhxgnvdBQ51PsKvd9S4b4TG6d9fmx:aOLT/z/o49gvjQv02bMGOcx
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Black Leecher v2.1.exe vmprotect
Files
-
Black Leecher v2.1.rar.rar
-
Black Leecher v2.1.exe.exe windows x86
1c3089afeecd11feebb05bc59eea335a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ