blackcat | blk[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
blk.exe.zip
Size 1.6MB
Sample240731-h7pegaxfjg
SHA256 eef0d80a4612c4639c37293b328e105a41149ae09c37b09eedcba3dc2ab20697
MD5 eee5a0d809a95e2c4f8178561606c213
SHA1 8f6fb652164abfd639b3fe745d39eda80bcfbfdf
SHA512 86ddf58b2830e6ae789a01ddb161a10a7514b5b0d1965a9608c5c6db5a548c6b135c084c4bbb7b9bc9bf07c38887da3ffd7606cd2dbf02d41990360d5b6c9d46
SSDEEP 49152:qaXTIqHq+QqVqCv+B/UlHHn/vfc1PwY2eH:qW1VFmalHH/c1P72eH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackcat

Malware Config

Extracted

Family

blackcat

Credentials

Username
CREDITONE\Administrator
Password
K3ny@2009

Credentials

Username
CREDITONE\bexec
Password
CloneD1sk4Song$%

Credentials

Username
CREDITONE\KLarry
Password
Kl..2021

Credentials

Username
CREDITONE\BKuhl
Password
Gromit2021!

Credentials

Username
CREDITONE\rlopez
Password
Victoria7856!

Credentials

Username
CREDITONE\EJaramilla
Password
1LoveVeros4

Credentials

Username
.\Administrator
Password
$fiji12$

Attributes

enable_network_discovery
true
enable_self_propagation
true
enable_set_wallpaper
true
extension
7954i9r
note_file_name
RECOVER-${EXTENSION}-FILES.txt
note_full_text
>> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/336eb50d-ebf8-436b-937d-ec075de46e7f/419ef3f950d9f346cf86db56db453539dcd51567ea871728e78dbc9918c7efeb >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Signatures

Blackcat family
blackcat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/blk.exe

File Explorer

blk.exe.zip

.zip 1.6MB
blk.exe

.exe 2.9MB

blk.exe.zip

SHA256 eef0d80a4612c4639c37293b328e105a41149ae09c37b09eedcba3dc2ab20697
MD5 eee5a0d809a95e2c4f8178561606c213
SHA1 8f6fb652164abfd639b3fe745d39eda80bcfbfdf
SHA512 86ddf58b2830e6ae789a01ddb161a10a7514b5b0d1965a9608c5c6db5a548c6b135c084c4bbb7b9bc9bf07c38887da3ffd7606cd2dbf02d41990360d5b6c9d46
SSDEEP 49152:qaXTIqHq+QqVqCv+B/UlHHn/vfc1PwY2eH:qW1VFmalHH/c1P72eH
MD5 SHA1 SHA512 SSDEEP

blk.exe

IMPHASH 55c1bce75ad836c886b7fb6bca398063
SHA256 731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161
MD5 173c4085c23080d9fb19280cc507d28d
SHA1 a186c08d3d10885ebb129b1a0d8ea0da056fc362
SHA512 626c4dbc60988566446e2e59840953cb53ec9ad64914ab2758519941f60aa27db9ff574a188cf32039690f1f34a6834f8c3804f2aa1f89b409d9a98c07ea8267
SSDEEP 49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4N1/RgaJ2w1M:rAnCs8pVblGyNM+l4UxUc1BhFDvww1M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CloseServiceHandle ControlService CreateProcessWithLogonW EnumDependentServicesW EnumServicesStatusExW GetUserNameW LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AttachConsole CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateEventW CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetComputerNameExW GetComputerNameW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTimeZoneInformation GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MoveFileExW OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetVolumeMountPointW Sleep SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx Wow64DisableWow64FsRedirection WriteConsoleW WriteFile lstrlenW DeleteCriticalSection GetCurrentThreadId GetTickCount UnhandledExceptionFilter VirtualProtect VirtualQuery

netapi32

NetApiBufferFree NetServerEnum NetShareEnum

ntdll

NtOpenProcessToken NtQueryInformationToken RtlCaptureContext

ole32

CoGetObject CoInitializeEx CoUninitialize

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

shell32

SHTestTokenMembership

user32

SystemParametersInfoW

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo ioctlsocket recv recvfrom send sendto setsockopt

bcrypt

BCryptGenRandom

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _fpreset _initterm _iob _lock _onexit _unlock calloc ceil exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp _wcsicmp abort atexit vfprintf wcscat wcscat_s wcscpy wcscpy_s wcslen

userenv

GetUserProfileDirectoryW

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

861KB

Virtual Size

861KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

blk.exe.zip

blk.exe

advapi32

kernel32

netapi32

ntdll

ole32

rstrtmgr

shell32

user32

ws2_32

bcrypt

msvcrt

userenv

generic