Managed XDR

blackcat.exe — malware analysis report

File info

Filename
blackcat.exe
File type
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
File size
2.2 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
ea350671cad165f47ad559b1494fd9a869419161
SHA256
5ebf613d09b1d4a95008db9ca054940bcfb569994ea76b6748d883fe94e2bc88
MD5
e59061e77c141a9d3ac6e3f7fb215ca7

Signatures

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
no_graphical_activity: No graphic activity
pe_overlay: PE file contains overlay