blackmoon | 18e5332b8cbac71afa96eb08cd692be0596351b11c189a2beb47ddc9162fcbdf

Sharing

Copy URL Twitter E-mail

General

Target

18e5332b8cbac71afa96eb08cd692be0596351b11c189a2beb47ddc9162fcbdf
Size

244KB
MD5

0259c38e1deda226b134c94644e05cb0
SHA1

499cff53089801c6cbfa89ab17b547e43e2e16f5
SHA256

18e5332b8cbac71afa96eb08cd692be0596351b11c189a2beb47ddc9162fcbdf
SHA512

3d5635d979850c4c5ac3375a2f0aebc8d7c46d72b748de7fc27fccae7d62d468addc142499449e2934c596dc98aec6322ac824d2f5a3ccff8d4d02fe0e5fdd46
SSDEEP

6144:ikWFwCOQQEjmF7L6bMP/iP3hxUttzfsxf3pF:ikWaCNKF7L6bMPK3hGtDsl

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Files

18e5332b8cbac71afa96eb08cd692be0596351b11c189a2beb47ddc9162fcbdf
.exe windows x86

361343ba1dd272d69e75fc469d52538c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempFileNameA
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
CopyFileA
CreateProcessA
GetStartupInfoA
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLCID
WriteFile
CreateFileA
GetCommandLineA
LCMapStringA
GetComputerNameA
GetTickCount
lstrlenA
ReadProcessMemory
LocalFree
IsBadCodePtr
SetUnhandledExceptionFilter
FlushFileBuffers
SetStdHandle
LocalAlloc
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
RaiseException
VirtualAlloc
LCMapStringW
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
RtlUnwind
InterlockedIncrement
InterlockedDecrement
GetLastError
SetSystemPowerState
Sleep
TerminateThread
CreateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetProcessWorkingSetSize
MoveFileExA
GetCurrentThreadId
FreeLibrary
RtlFillMemory
GetCurrentProcess
GetVersion
GetProcAddress
LoadLibraryA
TerminateProcess
OpenProcess
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVersionExA
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetWindowsDirectoryA
CloseHandle
SetWaitableTimer
CreateWaitableTimerA
RtlMoveMemory
lstrcpyn
LocalSize
GetModuleHandleA

ws2_32

htons
connect
ioctlsocket
WSAStartup
gethostbyname
WSACleanup
inet_addr
recv
inet_ntoa
send
__WSAFDIsSet
select
closesocket
shutdown
socket
WSAGetLastError

user32

ReleaseDC
SetTimer
FillRect
GetSysColor
DefWindowProcA
CallWindowProcA
GetDC
GetWindowRect
UpdateWindow
GetClassInfoExA
RegisterClassExA
LoadIconA
LoadCursorA
MoveWindow
BeginPaint
PeekMessageA
wsprintfA
MessageBoxA
ClipCursor
EndPaint
InvalidateRect
GetParent
SendMessageA
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
DrawIcon
GetIconInfo
GetCursorInfo
GetDesktopWindow
GetSystemMetrics
SetWindowPos
SetWindowRgn
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
EqualRect
IntersectRect
GetWindowLongA
SetWindowLongA
PostQuitMessage
CreateWindowExA
SetWindowTextA
GetWindowTextLengthA
IsWindow
EnableWindow
MsgWaitForMultipleObjects
ShowWindow
SetForegroundWindow
SetActiveWindow
AttachThreadInput
PostMessageA
IsWindowVisible
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
EnumWindows
ExitWindowsEx
KillTimer
TrackMouseEvent

advapi32

RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
GetUserNameA
RegOpenKeyExA

shell32

ShellExecuteA

ole32

CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
CLSIDFromString

gdi32

SetBkColor
DeleteObject
CreatePatternBrush
StretchBlt
CreateSolidBrush
DeleteDC
BitBlt
SelectObject
GetObjectA
TextOutA
SetTextColor
CreateDIBitmap
CreateRectRgn
GetPixel
CreateCompatibleDC
CombineRgn
CreateDIBSection
GdiFlush

iphlpapi

GetIpAddrTable

wininet

InternetOpenA
InternetConnectA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetCloseHandle

msimg32

TransparentBlt

secur32

GetUserNameExA

shlwapi

DllGetVersion
PathFileExistsA

oleaut32

RegisterTypeLi
SafeArrayCreate
LHashValOfNameSys
LoadTypeLi
SafeArrayDestroy
VariantClear
SysAllocString

icmp

IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle

Sections

.text
Size: 196KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

361343ba1dd272d69e75fc469d52538c

Headers

File Characteristics

Imports

kernel32

ws2_32

user32

advapi32

shell32

ole32

gdi32

iphlpapi

wininet

msimg32

secur32

shlwapi

oleaut32

icmp

Sections

.text Size: 196KB - Virtual size: 193KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 32KB - Virtual size: 115KB

.text
Size: 196KB - Virtual size: 193KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 32KB - Virtual size: 115KB