blackmoon | 9c8bca955a0615c71b0e1c036989742b1668353197b6b40d6ce7dfcb4fa07c74

Sharing

Copy URL Twitter E-mail

General

Target

9c8bca955a0615c71b0e1c036989742b1668353197b6b40d6ce7dfcb4fa07c74
Size

1.9MB
MD5

f3fd65ef74aa431e3c820817cf2198bf
SHA1

39cb0f00535976853d803fd947f7566c5c9445ec
SHA256

9c8bca955a0615c71b0e1c036989742b1668353197b6b40d6ce7dfcb4fa07c74
SHA512

17430cace4485a83c3f30267dd42bf297c82f298b2ef1291f9728de5586c6d7ea49564a3d263785c5ebe861deefbcf357f86be9190951ed92c194f2f6e5016b8
SSDEEP

24576:9wUUbT9odYT/YUa1LqNjPcadcdgp0PAy/t1dn6y0Kjq+a+cis3omtxINUQ/lqBJN:94T9HQ40CDpMtU+a8mtxERcBJrh0Y

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Files

9c8bca955a0615c71b0e1c036989742b1668353197b6b40d6ce7dfcb4fa07c74
.exe windows x86

0671e4ea667f8e48230571bdd99a52e8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringA
FreeLibrary
GetCommandLineA
FormatMessageA
GetUserDefaultLCID
GetStartupInfoA
CreateProcessA
WaitForSingleObject
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCommandLineW
SetFileAttributesA
DeleteFileA
GetFileSize
ReadFile
CreateFileA
WriteFile
GetModuleFileNameA
IsBadReadPtr
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
LocalSize
GlobalSize
CreateWaitableTimerA
LocalFree
CreateThread
lstrlenA
RtlMoveMemory
LocalAlloc
lstrlenW
GetLocalTime
GetCurrentProcessId
IsWow64Process
GetCurrentProcess
LoadLibraryA
GetSystemDirectoryA
CreateDirectoryW
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
SetWaitableTimer
CreateWaitableTimerW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
VirtualFree
VirtualAlloc
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
MultiByteToWideChar
GetNativeSystemInfo
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
SetStdHandle
HeapSize
GetACP
RaiseException
GetSystemTime
RtlUnwind
GetOEMCP
GetCPInfo
SetErrorMode
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
lstrcpynA
FlushFileBuffers
GetProcAddress
GetModuleHandleW
GetProcessHeap
MulDiv
InterlockedDecrement
InterlockedIncrement
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
GetVersion
GetTimeZoneInformation
lstrcatA
SetLastError
lstrcpyA
Sleep
OpenProcess
TerminateProcess
SetFilePointer
GetTickCount
GetTempPathA
GetWindowsDirectoryA
GetVersionExA
GetLastError

user32

KillTimer
GetAsyncKeyState
IntersectRect
InvalidateRect
UpdateLayeredWindow
ReleaseCapture
PostMessageW
IsZoomed
IsIconic
GetPropA
LoadCursorFromFileW
SetTimer
PtInRect
ReleaseDC
SetCaretPos
GetCursorPos
GetWindowRect
CallWindowProcW
TrackMouseEvent
ShowWindow
BeginPaint
EndPaint
SetCapture
GetFocus
SetFocus
SetWindowLongW
SetWindowPos
SetPropA
GetClassLongW
GetWindowTextW
GetParent
SetWindowRgn
GetSystemMetrics
RemovePropA
SetForegroundWindow
MessageBoxA
wsprintfA
EnableWindow
IsWindowEnabled
GetForegroundWindow
GetActiveWindow
SetActiveWindow
GetClassNameA
GetWindowThreadProcessId
FindWindowA
GetDC
UpdateWindow
GetClassNameW
SetWindowLongA
GetWindowTextA
GetWindowLongA
IsWindowVisible
GetWindow
SetWindowTextA
PostQuitMessage
PostMessageA
GetLastActivePopup
SetWindowsHookExA
ValidateRect
CallNextHookEx
GetKeyState
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
SendMessageA
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetDlgCtrlID
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
GetWindowPlacement
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
CallWindowProcA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
DestroyMenu
DispatchMessageA
GetMessageA
PeekMessageA
SendMessageW
CreateWindowExW
MsgWaitForMultipleObjects
CopyImage
SetCursor
DispatchMessageW
TranslateMessage
MoveWindow
SystemParametersInfoA
DefWindowProcW
RegisterClassExW
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
LoadCursorW
GetMessageW
IsWindow
GetDlgItem

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW
Shell_NotifyIconW
ShellExecuteA

ole32

CLSIDFromString
StringFromGUID2
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromProgID
OleRun
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize

shlwapi

PathFileExistsA
PathIsDirectoryW

gdi32

SetBkColor
GetStockObject
GetObjectA
GetDIBits
CreateRectRgn
CreateRoundRectRgn
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
BitBlt
GetDeviceCaps
CreateBitmap
RestoreDC
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SaveDC

wininet

HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetOpenA
InternetConnectA
InternetCloseHandle

gdiplus

GdipMeasureString
GdipGetFontHeight
GdipCreateSolidFill
GdipDrawString
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSetCompositingQuality
GdipSetInterpolationMode
GdipDrawImageRect
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipGetStringFormatAlign
GdipGetStringFormatTrimming
GdipGetStringFormatFlags
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipLoadImageFromStream
GdipSaveImageToStream
GdipDeleteBrush
GdipGetImageEncoders
GdipSetStringFormatMeasurableCharacterRanges
GdipCreateRegion
GdipMeasureCharacterRanges
GdipGetRegionBounds
GdipDeleteRegion
GdipCreateRegionHrgn
GdipDrawPath
GdipDeletePath
GdipCreatePath
GdipAddPathArc
GdipClosePathFigure
GdipFillPath
GdipCreateLineBrush
GdipCreatePen2
GdipFillPolygon
GdipDrawPolygon
GdipCreatePathGradientFromPath
GdipGetCompositingQuality
GdipCreateHBITMAPFromBitmap
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipDeleteStringFormat
GdipSetStringFormatHotkeyPrefix
GdipGetImageEncodersSize
GdipCreateStringFormat
GdipBitmapUnlockBits
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipCloneBitmapArea
GdipGetImagePixelFormat
GdipDrawImageRectRect
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipSetPenDashStyle
GdipSetStringFormatAlign
GdipDeletePen
GdipDrawRectangle
GdipSetClipRect
GdipSetClipRegion
GdipGraphicsClear
GdipResetClip
GdipGetFontStyle
GdipGetFontSize
GdipGetFamilyName
GdipDeleteFont
GdipCreateFont
GdiplusStartup
GdipCreateImageAttributes
GdipCreateFontFamilyFromName
GdipBitmapLockBits
GdipDeleteFontFamily

oleaut32

SafeArrayCreate
VariantCopy
RegisterTypeLi
SysAllocString
VariantClear
SafeArrayDestroy
SystemTimeToVariantTime
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VarR8FromBool
VarR8FromCy
OleLoadPicture

imm32

ImmAssociateContext
ImmGetContext

ws2_32

WSACleanup
WSAStartup
closesocket
select
recv
send

rasapi32

RasHangUpA
RasGetConnectStatusA

oledlg

ord8

advapi32

RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comctl32

ord17

Sections

.text
Size: 704KB - Virtual size: 701KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0671e4ea667f8e48230571bdd99a52e8

Headers

File Characteristics

Imports

kernel32

user32

shell32

ole32

shlwapi

gdi32

wininet

gdiplus

oleaut32

imm32

ws2_32

rasapi32

oledlg

advapi32

winspool.drv

comctl32

Sections

.text Size: 704KB - Virtual size: 701KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 1.2MB - Virtual size: 1.4MB

.rsrc Size: 20KB - Virtual size: 17KB

.text
Size: 704KB - Virtual size: 701KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 1.2MB - Virtual size: 1.4MB

.rsrc
Size: 20KB - Virtual size: 17KB