blackcat | 3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc.zip
Size 1.6MB
Sample231230-tk8elscfa7
SHA256 76d4218ed851e8546f55904f90ad5cacd7a806862ec17d68bb09ad9e46e8b182
MD5 25693a812ac4b5b12559937595917d61
SHA1 ac5b40c937a1deb00c6a761e0799bf8e58fc59ec
SHA512 561e269e07fb6a041cd27ccc77e10030a516c0d0814fc8f5c222a76ec28240e682a72340d5bffd913744c9ad31ba85680037d81a3b223ba7cd2a34ffdddefa06
SSDEEP 49152:7zu+VojqQknZqMqV1YrW7qelj8ujNiHWJH:nulknXu2rW7qelj8uc+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackcat

Malware Config

Extracted

Family

blackcat

Attributes

enable_network_discovery
true
enable_self_propagation
true
enable_set_wallpaper
true
extension
cvz8n37
note_file_name
RECOVER-${EXTENSION}-FILES.txt
note_full_text
>> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your network was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://gbxbwicx3x35kn7n73opnpp4kkzjcra42iv2akoo2dcjinf6jf6qbuyd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Signatures

Blackcat family
blackcat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc.exe

File Explorer

3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc.zip

.zip 1.6MB
3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc.exe

.exe 2.9MB

3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc.zip

SHA256 76d4218ed851e8546f55904f90ad5cacd7a806862ec17d68bb09ad9e46e8b182
MD5 25693a812ac4b5b12559937595917d61
SHA1 ac5b40c937a1deb00c6a761e0799bf8e58fc59ec
SHA512 561e269e07fb6a041cd27ccc77e10030a516c0d0814fc8f5c222a76ec28240e682a72340d5bffd913744c9ad31ba85680037d81a3b223ba7cd2a34ffdddefa06
SSDEEP 49152:7zu+VojqQknZqMqV1YrW7qelj8ujNiHWJH:nulknXu2rW7qelj8uc+
MD5 SHA1 SHA512 SSDEEP

Password

infected

3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc.exe

IMPHASH 55c1bce75ad836c886b7fb6bca398063
SHA256 3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc
MD5 5178bd507c07bc2d5274e0947834e48e
SHA1 dd69b20eb1931487d8b65060f2be3671bd5baf33
SHA512 4db7e98aaaf177fab9faa12f7ae9ee9415ef81fc0b0b31eb47b14fbf04ed899c32df70b984d0b6b2acf43e3a62d9c48624fe2ad86eccc5d0cb1015fc65983341
SSDEEP 49152:HFyDutqkpj1TFUoXhjEjHjTu5tCeOZobIMfutoqKNi/RgaJ2weF:HFyDkNLXVEbjTuieOaR2+6vwweF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CloseServiceHandle ControlService CreateProcessWithLogonW EnumDependentServicesW EnumServicesStatusExW GetUserNameW LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AttachConsole CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateEventW CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetComputerNameExW GetComputerNameW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTimeZoneInformation GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MoveFileExW OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetVolumeMountPointW Sleep SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx Wow64DisableWow64FsRedirection WriteConsoleW WriteFile lstrlenW DeleteCriticalSection GetCurrentThreadId GetTickCount UnhandledExceptionFilter VirtualProtect VirtualQuery

netapi32

NetApiBufferFree NetServerEnum NetShareEnum

ntdll

NtOpenProcessToken NtQueryInformationToken RtlCaptureContext

ole32

CoGetObject CoInitializeEx CoUninitialize

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

shell32

SHTestTokenMembership

user32

SystemParametersInfoW

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo ioctlsocket recv recvfrom send sendto setsockopt

bcrypt

BCryptGenRandom

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _fpreset _initterm _iob _lock _onexit _unlock calloc ceil exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp _wcsicmp abort atexit vfprintf wcscat wcscat_s wcscpy wcscpy_s wcslen

userenv

GetUserProfileDirectoryW

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

863KB

Virtual Size

863KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc.zip

3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc.exe

advapi32

kernel32

netapi32

ntdll

ole32

rstrtmgr

shell32

user32

ws2_32

bcrypt

msvcrt

userenv

generic