blackcat | 20982ebcf2153ed7d8fa4cdce4266415527d54bd648f54ba839fe0687abff551

Sharing

Copy URL Twitter E-mail

General

Target
20982ebcf2153ed7d8fa4cdce4266415527d54bd648f54ba839fe0687abff551
Size 1.3MB
Sample240522-plb1ksba41
SHA256 20982ebcf2153ed7d8fa4cdce4266415527d54bd648f54ba839fe0687abff551
MD5 4b7d145e4b10eeecaba85f9f9244b2b2
SHA1 99cd23d3f6ed2dda36fcc216b42ea79e74abbfeb
SHA512 ffc6b6b56900c99d18988dd5406397e797265caaa1b325a426c19a894d013ba9b4dc496c7c2fd5d0dd6c78b6245980f060afcf86a1c85517d80bb462b16418c9
SSDEEP 24576:R399qM32ii+jnCxgxxwFXVrzO5v3Ny5rCQnX7wfugm2qQElyAjNdx9hxj3qAsBIN:RN992p+jnCMw5Fy9mEwN5RH9TNsC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackcat

Malware Config

Extracted

Family

blackcat

Attributes

enable_network_discovery
true
enable_self_propagation
true
enable_set_wallpaper
true
extension
7954i9r
note_file_name
RECOVER-${EXTENSION}-FILES.txt
note_full_text
>> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/336eb50d-ebf8-436b-937d-ec075de46e7f/419ef3f950d9f346cf86db56db453539dcd51567ea871728e78dbc9918c7efeb >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Signatures

Blackcat family
blackcat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb

File Explorer

20982ebcf2153ed7d8fa4cdce4266415527d54bd648f54ba839fe0687abff551

.7z 1.3MB
f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb

.exe 2.9MB

20982ebcf2153ed7d8fa4cdce4266415527d54bd648f54ba839fe0687abff551

SHA256 20982ebcf2153ed7d8fa4cdce4266415527d54bd648f54ba839fe0687abff551
MD5 4b7d145e4b10eeecaba85f9f9244b2b2
SHA1 99cd23d3f6ed2dda36fcc216b42ea79e74abbfeb
SHA512 ffc6b6b56900c99d18988dd5406397e797265caaa1b325a426c19a894d013ba9b4dc496c7c2fd5d0dd6c78b6245980f060afcf86a1c85517d80bb462b16418c9
SSDEEP 24576:R399qM32ii+jnCxgxxwFXVrzO5v3Ny5rCQnX7wfugm2qQElyAjNdx9hxj3qAsBIN:RN992p+jnCMw5Fy9mEwN5RH9TNsC
MD5 SHA1 SHA512 SSDEEP

Password

infected

f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb

IMPHASH 55c1bce75ad836c886b7fb6bca398063
SHA256 f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb
MD5 817f4bf0b4d0fc327fdfc21efacddaee
SHA1 8917af3878fa49fe4ec930230b881ff0ae8d19c9
SHA512 b0f8c0f3e18765606db9c29199b617f5a757c5b12cdddeac1e91deaadef790b1134eb3c009b0eab36096391d93c8fa6abcb983426bc506ae79a63cadb7ea954b
SSDEEP 49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4NE/RgaJ2w1M:rAnCs8pVblGyNM+l4UxUc1BhFyvww1M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CloseServiceHandle ControlService CreateProcessWithLogonW EnumDependentServicesW EnumServicesStatusExW GetUserNameW LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AttachConsole CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateEventW CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetComputerNameExW GetComputerNameW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTimeZoneInformation GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MoveFileExW OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetVolumeMountPointW Sleep SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx Wow64DisableWow64FsRedirection WriteConsoleW WriteFile lstrlenW DeleteCriticalSection GetCurrentThreadId GetTickCount UnhandledExceptionFilter VirtualProtect VirtualQuery

netapi32

NetApiBufferFree NetServerEnum NetShareEnum

ntdll

NtOpenProcessToken NtQueryInformationToken RtlCaptureContext

ole32

CoGetObject CoInitializeEx CoUninitialize

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

shell32

SHTestTokenMembership

user32

SystemParametersInfoW

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo ioctlsocket recv recvfrom send sendto setsockopt

bcrypt

BCryptGenRandom

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _fpreset _initterm _iob _lock _onexit _unlock calloc ceil exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp _wcsicmp abort atexit vfprintf wcscat wcscat_s wcscpy wcscpy_s wcslen

userenv

GetUserProfileDirectoryW

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

861KB

Virtual Size

861KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

20982ebcf2153ed7d8fa4cdce4266415527d54bd648f54ba839fe0687abff551

f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb

advapi32

kernel32

netapi32

ntdll

ole32

rstrtmgr

shell32

user32

ws2_32

bcrypt

msvcrt

userenv

generic