General

  • Target

    BlackHole.X.zip

  • Size

    4.0MB

  • MD5

    d7b4603b14e519134fe558845b465159

  • SHA1

    c8eb74e155051cf9af6fca02d8776ac89ba1e28e

  • SHA256

    6d7975b1046a4598a0a810d67713b4c61e26798f053f1e3d0ac88b7854134d17

  • SHA512

    283531d4726cd08ea8147282b15ce4f3bcaa68bd5d330be30e05ffb90c0cbc03338f95ba147c3b2c371c3b77525c6212d7e9e402899c1f7c8c15c5849d78b60e

  • SSDEEP

    98304:520Lr4Of9YGmRgesKHrKVbhEbMxpCa3NwPpgWww3ZX2r9ciI:5NLr405/KLKGEsHPZnZXEO

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • BlackHole.X.zip
    .zip
  • BlackHole X.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    dc5ffe84bd3b4405ea83f693b055c515


    Headers

    Imports

    Exports

    Sections

  • bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • workspace/Scripts/Admin Script (Infinite Yield).txt
  • workspace/Scripts/unctest.txt