Behavioral task
behavioral1
Sample
d48c5f6ef7cc60ba3fbbc2cc7eca3762be6f54a12313c6da690e126a0f409cbd.exe
Resource
win7-20220812-en
General
-
Target
d48c5f6ef7cc60ba3fbbc2cc7eca3762be6f54a12313c6da690e126a0f409cbd
-
Size
1.5MB
-
MD5
06f1e29ab1b7a233bca444f25c5a7eb5
-
SHA1
648d4568ce0122df1e66276d8157fd7f0c8e82e7
-
SHA256
d48c5f6ef7cc60ba3fbbc2cc7eca3762be6f54a12313c6da690e126a0f409cbd
-
SHA512
b64d8fe252d1420b254467546b05ed4fd2d2ad3b5f3f422296504a24f79829530762087e8e150d8f83212dd6923d1a74d75a010821eb1bddc0b72cbd5a4be255
-
SSDEEP
24576:/aWq3JqkqmoR5BhQjATpDsQn1/tvA/0bgOZfdfg3GFrGTGyc4yuzxIL1vgT:/s5DqbBe4pNFvLbgOZfd43gi6PO6K
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon
Files
-
d48c5f6ef7cc60ba3fbbc2cc7eca3762be6f54a12313c6da690e126a0f409cbd.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
<E�)0 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
<E�)1 Size: 424KB - Virtual size: 424KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
<E�)2 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE