blackmoon | b6eaae7860fb552bb923496d5bade45cc1e8b3b8a0383878ac1461740eb4bf83

Sharing

Copy URL Twitter E-mail

General

Target

b6eaae7860fb552bb923496d5bade45cc1e8b3b8a0383878ac1461740eb4bf83
Size

48KB
MD5

69ee59ea5e7eaf57c22eba0feedc65f9
SHA1

0cb16cc257405d36cb4fc2000e0090322e960054
SHA256

b6eaae7860fb552bb923496d5bade45cc1e8b3b8a0383878ac1461740eb4bf83
SHA512

7ecfbd964d2e99849d562b4e7362a4075cfd4405b7f141f7c13980b294256ab163397e5a1a128f56a772ff3c77044f41b411d0797d61ec7c0cdf2c849b1952eb
SSDEEP

384:cZ0MD6TJtPcqJ1XBnRJ8P97Kkgr/UmNHz4WC2jYg8b/8wd70pWiW4RZmk8TcCY1:cZ0M+t0Kk61ZjmF0ZRZmk8TU

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Files

b6eaae7860fb552bb923496d5bade45cc1e8b3b8a0383878ac1461740eb4bf83
.dll windows x86

a3ea69e8dd24c3a125eac2cdab804ae4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
_initterm
strncpy
modf
malloc
free
strncmp
_ftol
??2@YAPAXI@Z
strtod
srand
sprintf
strrchr
_strnicmp
??3@YAXPAX@Z

kernel32

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CopyFileA
InitializeCriticalSection
LCMapStringA
GetCommandLineA
GetCurrentProcessId
OpenProcess
TerminateProcess
LoadLibraryA
CloseHandle
CreateThread
SetThreadPriority
GetVersionExA
GetCurrentThreadId
QueryPerformanceFrequency
GetCurrentProcess
GetModuleHandleA
GetModuleFileNameA
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetCurrentDirectoryA
GetPrivateProfileStringA
Sleep
WritePrivateProfileStringA
GetTickCount
MultiByteToWideChar
WideCharToMultiByte

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegSetValueExA
RegCreateKeyExA
OpenProcessToken

ntdll

ZwResumeProcess

user32

TranslateMessage
DispatchMessageA
PeekMessageA
wsprintfA
MessageBoxA
GetMessageA

ole32

CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
CLSIDFromString

oleaut32

VarR8FromCy
VarR8FromBool
LoadTypeLi
SafeArrayDestroy
VariantClear
SafeArrayCreate
SysAllocString
RegisterTypeLi

Exports

Exports

guard_end
guard_start

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3ea69e8dd24c3a125eac2cdab804ae4

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

ntdll

user32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 50KB

.rsrc Size: 4KB - Virtual size: 824B

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 50KB

.rsrc
Size: 4KB - Virtual size: 824B

.reloc
Size: 4KB - Virtual size: 1KB