Threat hunting assisted by BlackEnergy mark

First, let me thank everyone for the feedback and comments on the previous article. It was quite thrilling to see how the theory holds up in practice.

After the article has been published, our colleagues from Talos shared with us the results of the signature application; all samples have been tested by us on VirusTotal and are recorded in the following table:

As you can see from the table, we have 7 samples that had first appeared on the VirusTotal in the last couple of days.

The oldest sample is more than 8 years old.

There is one sample that is identified only by three anti-virus solutions – cd86b354334af457c474c13901d905745edebbef5c23a276854cd2fb26795917 – and one of those solutions classifies it as BlackEnergy:

It has appeared just one day ago:

I propose you to join the hunt and fill in this table with your samples. It will be interesting to see the oldest sample and how many different samples we can “catch”. You can write the hashes right here in the comments. I hope the “hunt” for new samples will reveal patterns that are even more interesting.

Updated on March 11th

We have received three more samples. Based on the virus name, file size and other parameters it is obvious that we are dealing with mutation of the same source code, though as mentioned in the article the common attribute for these samples are the same hashes (8 bytes). Thus we can observe that this is yet another example how our simple signature has helped to tie the three samples to the same tool that was used to process the code during Weaponization phase before being delivered to the target. So despite the code mutation this could be detected earlier on during initial analysis stage.

Of course, I do realize that Yara-signature I have developed is not a silver bullet, but it does help to conduct an interesting observation where such a simple method can reveal whole patters, a kind of litmus test.