blackmoon | 19c919716fbcb3bca095249019fc108aba1bcce94a727b7a279e86716245d2c2

Sharing

Copy URL Twitter E-mail

General

Target

19c919716fbcb3bca095249019fc108aba1bcce94a727b7a279e86716245d2c2
Size

512KB
MD5

dbd27e58b19e63c152d9e79fcaf7bba0
SHA1

b3f6faf5dc9ca7498c1eacb97239486efded1dd2
SHA256

19c919716fbcb3bca095249019fc108aba1bcce94a727b7a279e86716245d2c2
SHA512

f6caaa37884977f1c9069d694721ce0bf12d7b9259d4b784d31d7fd60a29a73b7ce090cbe2245dc449499c2a4427e930257caf1f91f2743df88b7b112869fbb0
SSDEEP

6144:m5CEtB49oLfhL9GoTCz6dte55SVAax3E2Ffp8949lxLtqP+A5AOfMZfysjc:mAEbhLfhRGgZ7ejS9JxFkk/qVmZfysj

Score

10^/10

blackmoon gozi_ifsb

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Gozi_ifsb family
gozi_ifsb

Files

19c919716fbcb3bca095249019fc108aba1bcce94a727b7a279e86716245d2c2
.dll windows x86

b62ee52bf7db93c2c4bc82c68e6f1396

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
GetModuleHandleA
GetCommandLineA
GetProcessHeap
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualProtect
DeleteFileA
RtlMoveMemory
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetVersion
RtlUnwind
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

user32

TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
GetMessageA
PeekMessageA

shlwapi

PathFileExistsA

shell32

SHGetSpecialFolderPathA

Exports

Exports

DevRtlCloseTextLogSection
DevRtlCreateTextLogSectionA
DevRtlCreateTextLogSectionW
DevRtlGetThreadLogToken
DevRtlSetThreadLogToken
DevRtlWriteTextLog
DevRtlWriteTextLogError
HidD_FlushQueue
HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetConfiguration
HidD_GetFeature
HidD_GetHidGuid
HidD_GetIndexedString
HidD_GetInputReport
HidD_GetManufacturerString
HidD_GetMsGenreDescriptor
HidD_GetNumInputBuffers
HidD_GetPhysicalDescriptor
HidD_GetPreparsedData
HidD_GetProductString
HidD_GetSerialNumberString
HidD_Hello
HidD_SetConfiguration
HidD_SetFeature
HidD_SetNumInputBuffers
HidD_SetOutputReport
HidP_GetButtonCaps
HidP_GetCaps
HidP_GetData
HidP_GetExtendedAttributes
HidP_GetLinkCollectionNodes
HidP_GetScaledUsageValue
HidP_GetSpecificButtonCaps
HidP_GetSpecificValueCaps
HidP_GetUsageValue
HidP_GetUsageValueArray
HidP_GetUsages
HidP_GetUsagesEx
HidP_GetValueCaps
HidP_InitializeReportForID
HidP_MaxDataListLength
HidP_MaxUsageListLength
HidP_SetData
HidP_SetScaledUsageValue
HidP_SetUsageValue
HidP_SetUsageValueArray
HidP_SetUsages
HidP_TranslateUsagesToI8042ScanCodes
HidP_UnsetUsages
HidP_UsageListDifference
IsInteractiveUserSession
NdxTableAddObject
NdxTableAddObjectToList
NdxTableClose
NdxTableFirstObject
NdxTableFirstObjectInList
NdxTableGetObjectName
NdxTableGetObjectType
NdxTableGetObjectTypeCount
NdxTableGetObjectTypeName
NdxTableGetPropertyTypeClass
NdxTableGetPropertyTypeCount
NdxTableGetPropertyTypeName
NdxTableGetPropertyValue
NdxTableNextObject
NdxTableObjectFromName
NdxTableObjectFromPointer
NdxTableOpen
NdxTableRemoveObject
NdxTableRemoveObjectFromList
NdxTableSetObjectPointer
NdxTableSetPropertyValue
NdxTableSetTypeDefinition
QueryActiveSession
QueryUserToken
RegisterUsertokenForNoWinlogon
WTSCloseServer
WTSConnectSessionA
WTSConnectSessionW
WTSCreateListenerA
WTSCreateListenerW
WTSDisconnectSession
WTSEnableChildSessions
WTSEnumerateListenersA
WTSEnumerateListenersW
WTSEnumerateProcessesA
WTSEnumerateProcessesExA
WTSEnumerateProcessesExW
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSEnumerateServersW
WTSEnumerateSessionsA
WTSEnumerateSessionsExA
WTSEnumerateSessionsExW
WTSEnumerateSessionsW
WTSFreeMemory
WTSFreeMemoryExA
WTSFreeMemoryExW
WTSGetChildSessionId
WTSGetListenerSecurityA
WTSGetListenerSecurityW
WTSIsChildSessionsEnabled
WTSLogoffSession
WTSOpenServerA
WTSOpenServerExA
WTSOpenServerExW
WTSOpenServerW
WTSQueryListenerConfigA
WTSQueryListenerConfigW
WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSQueryUserConfigA
WTSQueryUserConfigW
WTSQueryUserToken
WTSRegisterSessionNotification
WTSRegisterSessionNotificationEx
WTSSendMessageA
WTSSendMessageW
WTSSetListenerSecurityA
WTSSetListenerSecurityW
WTSSetRenderHint
WTSSetSessionInformationA
WTSSetSessionInformationW
WTSSetUserConfigA
WTSSetUserConfigW
WTSShutdownSystem
WTSStartRemoteControlSessionA
WTSStartRemoteControlSessionW
WTSStopRemoteControlSession
WTSTerminateProcess
WTSUnRegisterSessionNotification
WTSUnRegisterSessionNotificationEx
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelOpenEx
WTSVirtualChannelPurgeInput
WTSVirtualChannelPurgeOutput
WTSVirtualChannelQuery
WTSVirtualChannelRead
WTSVirtualChannelWrite
WTSWaitSystemEvent

Sections

FLlf2
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

cKbh5c
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

6J1gd
Size: 416KB - Virtual size: 441KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

8M6bJ
Size: 4KB - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

bagm5K
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b62ee52bf7db93c2c4bc82c68e6f1396

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

shell32

Exports

Exports

Sections

FLlf2 Size: 72KB - Virtual size: 71KB

cKbh5c Size: 8KB - Virtual size: 7KB

6J1gd Size: 416KB - Virtual size: 441KB

8M6bJ Size: 4KB - Virtual size: 692B

bagm5K Size: 8KB - Virtual size: 7KB

FLlf2
Size: 72KB - Virtual size: 71KB

cKbh5c
Size: 8KB - Virtual size: 7KB

6J1gd
Size: 416KB - Virtual size: 441KB

8M6bJ
Size: 4KB - Virtual size: 692B

bagm5K
Size: 8KB - Virtual size: 7KB