blackmoon | db613044019b4939a85b58f59e3e00f18685a51e259c6c7b660577b55aa6a514

Sharing

Copy URL Twitter E-mail

General

Target

db613044019b4939a85b58f59e3e00f18685a51e259c6c7b660577b55aa6a514
Size

1.3MB
MD5

e168b4a07ad31a48218f05ddd2e951f3
SHA1

880a2a244fcf71be1c3e2b4350fe9bf31cd1457c
SHA256

db613044019b4939a85b58f59e3e00f18685a51e259c6c7b660577b55aa6a514
SHA512

ae005ac839cd9a9edbefb00f3ede61291b92f5bf1b50b84633ac92636b89cac5c3f6e346fc6ec8a6cceb662480d07134db50a3bc5b17de6e92785cdc00bc73ea
SSDEEP

24576:iv+tmzdhf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLYq:iTv+s8KuqGaX0ToIBAUZLYq

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Files

db613044019b4939a85b58f59e3e00f18685a51e259c6c7b660577b55aa6a514
.exe windows x86

8a86fe9c98660487a5a27387f40f4117

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetCommandLineA
DeleteFileA
WriteFile
GetTickCount
GetUserDefaultLCID
WritePrivateProfileStringA
GetPrivateProfileStringA
Sleep
CopyFileA
CreateDirectoryA
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
LCMapStringA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateEventA
lstrlenA
RtlFillMemory
ReadProcessMemory
GetCurrentProcess
InitializeCriticalSection
LocalSize
MapViewOfFile
OpenFileMappingA
Module32First
MultiByteToWideChar
GlobalFree
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
Beep
GetCurrentThread
CreateThread
SetWaitableTimer
CreateWaitableTimerA
GetCurrentThreadId
DeviceIoControl
CreateFileA
lstrcpyn
GetProcAddress
LoadLibraryA
LocalFree
WideCharToMultiByte
RtlMoveMemory
LocalAlloc
GetWindowsDirectoryA
GetTempPathA
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
InterlockedExchange
GetLocaleInfoW
SetStdHandle
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
RaiseException
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
SetErrorMode
GetProcessVersion
GlobalGetAtomNameA
SetFilePointer
GetLastError
GetVersionExA
TerminateProcess
lstrcpyA
GetSystemDirectoryA
VerLanguageNameA
SetLastError
lstrcatA
LockResource
LoadResource
FindResourceA
GetTimeZoneInformation
GetSystemDefaultLangID
GetLocaleInfoA
GetVersion
GetACP
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
MulDiv
FlushFileBuffers
lstrcpynA
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GlobalFindAtomA
GlobalAddAtomA

shlwapi

PathFileExistsA

user32

SetCursorPos
GetForegroundWindow
mouse_event
UnhookWindowsHookEx
KillTimer
CallWindowProcA
GetWindowThreadProcessId
SetWindowsHookExA
EnumWindows
ClientToScreen
LoadImageA
GetDC
ReleaseDC
CopyImage
GetKeyboardLayout
VkKeyScanExA
GetClassNameA
keybd_event
SystemParametersInfoA
GetCursorPos
PtInRect
GetWindow
SetCursor
IsWindowEnabled
GetLastActivePopup
SetTimer
GetKeyState
GetActiveWindow
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
TabbedTextOutA
DrawTextA
GrayStringA
SetActiveWindow
EndDialog
GetDlgCtrlID
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
GetWindowPlacement
RegisterWindowMessageA
SetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
GetClassLongA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
EnumDisplaySettingsA
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
DestroyMenu
FillRect
TrackMouseEvent
InvalidateRect
IsWindow
AttachThreadInput
SetFocus
MapVirtualKeyA
SendInput
EndPaint
BeginPaint
MsgWaitForMultipleObjects
IsIconic
GetClientRect
PostMessageA
GetParent
GetWindowRect
MoveWindow
GetClassInfoExA
ValidateRect
GetSystemMetrics
PeekMessageA
CreateDialogIndirectParamA
UpdateWindow
GetMessageA
SendMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
SetWindowTextA
GetDlgItem
ShowWindow
SetWindowLongA
ScreenToClient
GetWindowLongA
GetWindowTextA
wsprintfA
MessageBoxA
SetWindowPos
SetWindowRgn
DestroyWindow
EqualRect
IntersectRect
CreateWindowExA
GetWindowTextLengthA
EnableWindow
GetClipboardData
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SetRect
PrintWindow
IsWindowVisible
CallNextHookEx

gdi32

CombineRgn
CreateRectRgn
TextOutA
SetBkColor
StretchBlt
SetPixelV
GetPixel
CreatePatternBrush
SetDIBitsToDevice
GetObjectA
CreateCompatibleBitmap
CreateDIBSection
CreateCompatibleDC
DeleteObject
CreateDIBitmap
CreateSolidBrush
DeleteDC
BitBlt
GetStockObject
GetDIBits
SetTextColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
CreateFontA
Escape
ExtTextOutA
RectVisible
PtVisible
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SelectObject

advapi32

RegOpenKeyExA
GetUserNameA
RegCreateKeyExA
RegNotifyChangeKeyValue
RegRestoreKeyA
RegSaveKeyA
RegEnumValueA
RegEnumKeyA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegFlushKey
RegQueryValueExA
RegCloseKey
RegOpenKeyA
RegCreateKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
ord680

ole32

OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
CLSIDFromString
CoCreateInstance
CLSIDFromProgID
OleRun
OleIsCurrentClipboard

msimg32

TransparentBlt

oledlg

ord8

oleaut32

VariantInit
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayGetDim

ws2_32

WSAStartup
WSACleanup
listen
closesocket
bind
htons
socket
accept
__WSAFDIsSet
select
recv
send
inet_ntoa
getsockname
gethostbyname
gethostname
sendto
recvfrom
htonl
inet_addr
connect
ntohs
getpeername

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

comctl32

ord17

Sections

.text
Size: 372KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 828KB - Virtual size: 827KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8a86fe9c98660487a5a27387f40f4117

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

gdi32

advapi32

shell32

ole32

msimg32

oledlg

oleaut32

ws2_32

version

winspool.drv

comctl32

Sections

.text Size: 372KB - Virtual size: 370KB

.rdata Size: 828KB - Virtual size: 827KB

.data Size: 32KB - Virtual size: 143KB

.rsrc Size: 68KB - Virtual size: 67KB

.text
Size: 372KB - Virtual size: 370KB

.rdata
Size: 828KB - Virtual size: 827KB

.data
Size: 32KB - Virtual size: 143KB

.rsrc
Size: 68KB - Virtual size: 67KB