blackcat | 56146d976cf9741cbadfada0c52a2f33[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
56146d976cf9741cbadfada0c52a2f33.bin
Size 1.6MB
Sample240310-b9bstshe8t
SHA256 fb498ec79ef20691c23b9fd768ffd6caf1b98d49b0b165a5767d2471c3182900
MD5 56146d976cf9741cbadfada0c52a2f33
SHA1 eadcfda43e04a0974678eba5a43d10393be93f31
SHA512 24b3669097a353764ad2ce1f3d2f0221a6fe744f14b31fff2d1080c6156f0956c52ef334ff148f0b2d10be9d05e432aded073762faf08b66876f04f08ecc0ecf
SSDEEP 49152:LSn4N41F3Zalps3JbPDSPqTZRr0QgRWbWN15H:LSnw63J2mZ90LRWbW7N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackcat

Malware Config

Extracted

Family

blackcat

Credentials

Username
CEKOK\comodo
Password
Ngn2016!

Attributes

enable_network_discovery
true
enable_self_propagation
true
enable_set_wallpaper
true
extension
b5o8ph3
note_file_name
RECOVER-${EXTENSION}-FILES.txt
note_full_text
>> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://aoczppoxmfqqthtwlwi4fmzlrv6aor3isn6ffaiic55wrfumxslx3vyd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Signatures

Blackcat family
blackcat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/BlackCat_Config.exe

File Explorer

56146d976cf9741cbadfada0c52a2f33.bin

.zip 1.6MB
f66f7ed98ea839175949bd6148be4277a4d566aa9b912981a2be485e851cf5c4

.zip 1.6MB
BlackCat_Config.exe

.exe 2.9MB
UseTool.txt

26B

56146d976cf9741cbadfada0c52a2f33.bin

SHA256 fb498ec79ef20691c23b9fd768ffd6caf1b98d49b0b165a5767d2471c3182900
MD5 56146d976cf9741cbadfada0c52a2f33
SHA1 eadcfda43e04a0974678eba5a43d10393be93f31
SHA512 24b3669097a353764ad2ce1f3d2f0221a6fe744f14b31fff2d1080c6156f0956c52ef334ff148f0b2d10be9d05e432aded073762faf08b66876f04f08ecc0ecf
SSDEEP 49152:LSn4N41F3Zalps3JbPDSPqTZRr0QgRWbWN15H:LSnw63J2mZ90LRWbW7N
MD5 SHA1 SHA512 SSDEEP

Password

infected

BlackCat_Config.exe

IMPHASH 55c1bce75ad836c886b7fb6bca398063
SHA256 c5ad3534e1c939661b71f56144d19ff36e9ea365fdb47e4f8e2d267c39376486
MD5 c681038bc738ff0a816176c4cd21150c
SHA1 c5181892afde538c73109b4c83e2a2730eb9014d
SHA512 defabbcf84219a69366c01e2c1cfe72cd1e29879434cddab31c2c035fc7958bce3611b5f9568ad8abce0d7bf28f1f718159e712d0fc7caf56185a20949f9b060
SSDEEP 49152:nKoWSw+biIUslcrZM2xTSQyAnsKN3uLlkoCP4QNS/RgaJ2wgX:nKoWSw+e9slcrq2xTpsKNOVoCvwwgX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

5312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CloseServiceHandle ControlService CreateProcessWithLogonW EnumDependentServicesW EnumServicesStatusExW GetUserNameW LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AttachConsole CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateEventW CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetComputerNameExW GetComputerNameW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTimeZoneInformation GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MoveFileExW OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetVolumeMountPointW Sleep SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx Wow64DisableWow64FsRedirection WriteConsoleW WriteFile lstrlenW DeleteCriticalSection GetCurrentThreadId GetTickCount UnhandledExceptionFilter VirtualProtect VirtualQuery

netapi32

NetApiBufferFree NetServerEnum NetShareEnum

ntdll

NtOpenProcessToken NtQueryInformationToken RtlCaptureContext

ole32

CoGetObject CoInitializeEx CoUninitialize

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

shell32

SHTestTokenMembership

user32

SystemParametersInfoW

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo ioctlsocket recv recvfrom send sendto setsockopt

bcrypt

BCryptGenRandom

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _fpreset _initterm _iob _lock _onexit _unlock calloc ceil exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp _wcsicmp abort atexit vfprintf wcscat wcscat_s wcscpy wcscpy_s wcslen

userenv

GetUserProfileDirectoryW

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

861KB

Virtual Size

861KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

56146d976cf9741cbadfada0c52a2f33.bin

f66f7ed98ea839175949bd6148be4277a4d566aa9b912981a2be485e851cf5c4

BlackCat_Config.exe

advapi32

kernel32

netapi32

ntdll

ole32

rstrtmgr

shell32

user32

ws2_32

bcrypt

msvcrt

userenv

generic

UseTool.txt