O�&�j�\T��d�_N"y� >`��:�� ]�3ۜ'�)�LT� q��q<t_ ����R�dy �8]P��7:w��H^y��_�u~��,A�����3���b�3͢�q�� U�КĿ�|_�t �L�vE��d� t�c�� k��ǝ�r�ߡ���9�K�C@������v�����]��3l�_�OT�k9�fc�&��S+ ��Z�!J&�>0Ks�b�ܸ[ N*�M��4�g&G"����t*-��)�|l�7���U>�`ǽ�?��b*U��� w �Ww���1��`s����Ӎ���8v-X\�ի yE)�#�����xp�2�n�ޗ��T(��o�:pi��8q��.�i�[K��!����|��l.�ۡ�]"KIIh���9�7/㼢i�ʃ]�2x`1�Va蠵 �O�I��#���6�t�o��)�i7�gƌ9�d^�I��N�(�z����I8��"։��e�=>5�=a�E�1.��k�pQߺ���k���l�0��Xn ��[/�J����h�NQ�q���ի��6���6F���"��eC&"@c��-`8�c�#j`���Nƃp���DI3�6i��4��0=$X�%]�0��s� xy�3������G�i�J&uӧ*Q��'��S���<|s�H��Ƽ�[�KhX��|��'��2��^0Dg�š�g(�����;���`Z�1�������ר��@=}8�t�Ru�=�tːY �:Uf�f�]Ⓞf� ƥ��3؍��0o�fY�H�� R���ޱ�Dki ����G n]��Z�A�={�c����g=T9�-e����HswK�����Q�E��R���V��9�^0&r���SaH�^t�^��ghrჾ�n�DzFˎM��K,T}��s���/#�*�|�D�'�����p� �����&��%�&��??�z5f8_%6\�vO{�j�[�J�1�@�.�]�����/����-�Zn<���̧W��"M���p_�Q) ���ؒܯ�뻹�29R,�e��&�l�G����ʉh+nA�սuHH���bcM�3(��L9�~����/vbg��蔮�Oޯ7��w�j�6���D��U�s�-�ۛ���X�EV�0���o��� ��@���E��W �S;�=��b.����:��G�~9J�:�b})�1}�ȓ������W��k5�2��}��zڱN6��( ����l$��<�b�K�Y�2V��o_ �ǽ�N�)vm�T��5���KMH�5B�F�Ќ�Ա�i)G �;~�v��l���+0�(cUJ-������[5��c��kp���J^�^�' '�O�7�����~\F��oXŧ�Țm�lIi0�sR=xR�{�Y�� Ԩ��S�� ��q�b+禚�1��Jr?_s\��&����8l��Dt�ү�d�I��9���ߠYW\kg�����_ԗ����[C��X�&��d=�O�5o��Ϣ����v�W��P<נ��"����^��>=���m�,���z�ۭ�,:%$A耹��l�����%���f�����;�;D3n�z�;0����J ���ߪn��`���Y�t�>���$А_u���� t'm��V*�y�C.r:ŗ��ӃZ ����� ���!��C:4�H��Յv�c22�d�������Q�9��r5����B������܉�`W�"�m\�1*+� ���k���#iUs�D]��W�!�n��a�+����!A1�w�vB�2�1�����E�>���kU��4-�Z3~�!��d������_`���1���,[��3��ڕ�&G�#��2g�@T������W��gD�$2i�"g-�ދ�o�h�+�sWe��� �"�J�E|�$�������ue���咊�gN�j? �G��R#N�q��۲KJӹx�˫��FxՊU�\�d�; �L7����m��C��s����J/�5�i���a����o�ӷj���a�F���2�h���oV���]���F�ZW5uѝ��L�Mn��F�w�!>��3�V�nrש�^��O\$big`���v��A��+ND���];ػ�3~���j�bI�X�={�R͖(� jnRc�mN�?sc*��q��k�Ǯ:�Ǥ'.��7L����~'Ģ*��������(������R/t{�Q�Pq���t�M��:��7�����{���]�߹���+���ǧ��C8��Z~��S��L"3��b�A]��ˉ�%�XI,oUg����r��������O���U^q�0��m ��{��,��0�����2 ��v�I���o���ug��=;G������I�n�7��������F���5N������4�G�4y�ɦ��U��4��ZÚ�n�o��tk��]� nת�� VK�}NNBƜ�Gt(uy�Y"92��1_}���QS⧜c�i��j��x�<�/���'U���#t����tğ磯f��`�9+|Q��ה��ߏ9A��v��|���` $�Ҋ���7w��R��#N��l�\K$jEJ��c.5�}U�t#��T&ê��,�Lj ��\��g�CuI���>��X:n�C���!)��Y��1��J��l���/�+X��X�v�Ӂ��t}�����3����B��6C���i��#N��0��_�V*kŝ������Q�&wx|hJ?*~ ����:�b�?��Ҡ�Y�6 ���n���o���:x?��=Ma�@J�Z� ��6�Ʊ{�)����9�\Lh+���J;�Dp4EHpg��/��_��G��;#= 9�~U03�(�k72�n& �c��+& ]���7<$�����<�E�����a�6=��dw�Ck7���H��U�#�(lj�.����d!0|�4�uX{�N���ͦݦ��y6Pp��u��ݑ�˹y�ѭT��4��A����π���������_������g��&YH��\� �"�?ۋ���xw|��ޛ[a ���{ =���^Hy��;���^1�/���_Sn���.���X$�[$����R:1���"���]����5GKy<WT�!��z��y���
Behavioral task
behavioral1
Sample
BlackSwipe.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
BlackSwipe.exe
Resource
win10v2004-20230915-en
General
-
Target
BlackSwipe.exe
-
Size
5.3MB
-
MD5
385c752299c91bf9c0829430e9b3f02d
-
SHA1
97631e8314016b764d2d666869b5f715dc651fa1
-
SHA256
488282dcae283e7b08c22f81c73801b5d8b235db5f39b901d0d594abb997bcef
-
SHA512
0ccbf598d09262f67524fb1df0342c2abccc656804907743af8810a9268ffe91a96e9292cc7fad599d02cb3a37ed0e1e9d8531599f2e89a50f24abd3c30f2983
-
SSDEEP
98304:6rRcIoebqkgSe89CqBwNz4fp0Q7PBjfiaeOPr/RXFsxGrwC4Ie2:6rRpoevBqz9mjqGP1VQGrje2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BlackSwipe.exe
Files
-
BlackSwipe.exe.exe windows:6 windows x64
b5936887830d2c3567b7d64934dbfc0b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ