blacknevas | 360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.bin
Size 1.8MB
Sample250925-sajstsbp2v
SHA256 360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8
MD5 f2547a80dd64dcd5cba164fe4558c2b6
SHA1 cdb07718787743ceb488b5bd184d9a4939c12dbf
SHA512 79adbc9680d37fe8e3767f97a29a0ea75578c5d8ff73737a0c87d46784e11366e66f99d3491e09ea2fba56244764c7837780c3165110831578080b67d3e0db2f
SSDEEP 24576:tCZBhx+3TMhb7Fke0x+X0vAAfVfUDC8+uzIXb1n+Gyj:YhxgTq+5UDC3rXp90
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blacknevas

Malware Config

Signatures

Blacknevas family
blacknevas

Detects Windows variant of BlackNevas ransomware 1 IoCs

resource	yara_rule
sample	family_blacknevas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.bin

File Explorer

360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.bin

.exe 1.8MB

360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.bin

IMPHASH 3912462c831d18da990f6c80fd69280d
SHA256 360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8
MD5 f2547a80dd64dcd5cba164fe4558c2b6
SHA1 cdb07718787743ceb488b5bd184d9a4939c12dbf
SHA512 79adbc9680d37fe8e3767f97a29a0ea75578c5d8ff73737a0c87d46784e11366e66f99d3491e09ea2fba56244764c7837780c3165110831578080b67d3e0db2f
SSDEEP 24576:tCZBhx+3TMhb7Fke0x+X0vAAfVfUDC8+uzIXb1n+Gyj:YhxgTq+5UDC3rXp90
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Detects Windows variant of BlackNevas ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1441344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetFileAttributesW GetFileTime GetFileType SetFileTime RtlUnwindEx GetACP CloseHandle LocalFree GetCurrentProcessId SizeofResource VirtualProtect UnlockFile QueryPerformanceFrequency IsDebuggerPresent FindNextFileW GetFullPathNameW VirtualFree ExitProcess HeapAlloc GetNumberOfConsoleInputEvents GetCPInfoExW RtlUnwind SetFilePointerEx GetCPInfo EnumSystemLocalesW GetStdHandle GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW GetFileSizeEx LoadLibraryA ResetEvent GetVolumeInformationW FreeResource GetVersion RaiseException MoveFileW FormatMessageW OpenProcess SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW TerminateProcess SetPriorityClass LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection GetDiskFreeSpaceExW SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority AllocConsole VirtualAlloc GetTempPathW GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage GetConsoleOutputCP LockFile GetConsoleCP PeekConsoleInputW lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar CreateMutexA SetEvent GetLocaleInfoW CreateFileW DeleteFileW IsDBCSLeadByteEx FreeConsole GetLocalTime WaitForSingleObject WriteFile FlushConsoleInputBuffer ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW GetThreadLocale SetThreadLocale

wsock32

gethostbyaddr WSAStartup closesocket socket

ws2_32

WSAIoctl

shell32

ShellExecuteW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CharUpperBuffA CharUpperBuffW CharNextW MsgWaitForMultipleObjects CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW

iphlpapi

GetIpNetTable

oleaut32

SysAllocStringLen SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate

netapi32

NetWkstaGetInfo NetApiBufferFree NetShareEnum

advapi32

CloseServiceHandle RegQueryValueExW RegCloseKey OpenSCManagerW RegOpenKeyExW EnumServicesStatusA EnumServicesStatusW

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

51KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

154B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

584B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

109B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.bin

kernel32

wsock32

ws2_32

shell32

version

user32

iphlpapi

oleaut32

netapi32

advapi32

generic