blackmoon | b5944d218b11760dac2ccf2d3f9f779a24134fc6162340a195f3378a3ffe91b3

Sharing

Copy URL

Twitter E-mail

General

Target

b5944d218b11760dac2ccf2d3f9f779a24134fc6162340a195f3378a3ffe91b3
Size

304KB
MD5

7423ee2327328809a3b363601315595c
SHA1

52ca099925b6881db0160802f36d69705a3c5891
SHA256

b5944d218b11760dac2ccf2d3f9f779a24134fc6162340a195f3378a3ffe91b3
SHA512

8d68d2ef102466f91144ae2e69ff0e8020e1c21197c68196c1aed1e2f0174404d941e323f93189d88b53137d69bdd6007c2badd0b1496c7a7de53a2c0cb95858
SSDEEP

6144:RBp56xcXxZTTnegFBMfnZWM0ZGkIccNc5:bE4TTQMM0ZGkT

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon
Detect Blackmoon payload 1 IoCs

Processes:

resource yara_rule

sample family_blackmoon

resource	yara_rule
sample	family_blackmoon

Files

b5944d218b11760dac2ccf2d3f9f779a24134fc6162340a195f3378a3ffe91b3
.exe windows x86

adf83af71e58fb2c4ed0dfcff4d7dfb3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringA
GetModuleFileNameA
InterlockedExchange
SetStdHandle
WriteFile
SetFilePointer
CreateFileA
GetTickCount
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CloseHandle
MoveFileA
CopyFileA
DeleteFileA
Sleep
GetCommandLineA
IsBadReadPtr
HeapReAlloc
ExitProcess
LocalSize
HeapAlloc
IsBadCodePtr
HeapFree
GetProcessHeap
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
VirtualAlloc
RtlMoveMemory
GetModuleHandleA
VirtualFree
HeapCreate
HeapDestroy
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateThread
Process32Next
Process32First
CreateToolhelp32Snapshot
GlobalFree
GlobalUnlock
GlobalLock
GetLastError
GetCurrentProcess
GetVersionExA
TerminateProcess
OpenProcess
GetProcAddress
FreeLibrary
lstrcpyA
LoadLibraryA
lstrlenA
MultiByteToWideChar
GlobalAlloc
SetLastError
lstrcatA
GetVersion
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
LocalFree
FlushFileBuffers
lstrcpynA
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetErrorMode
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA

shlwapi

PathFileExistsA

user32

wsprintfA
DispatchMessageA
TranslateMessage
PeekMessageA
LoadIconA
GetMessageA
SetMenuDefaultItem
CallWindowProcA
BeginPaint
EndPaint
GetAsyncKeyState
DefWindowProcA
GetClientRect
EndDialog
DestroyWindow
SendMessageA
DefMDIChildProcA
LoadCursorA
SetCursor
TrackMouseEvent
DestroyIcon
PostQuitMessage
SetWindowLongA
DestroyCursor
CreateWindowExA
GetWindowLongA
GetDlgItem
IsWindow
GetWindowThreadProcessId
FindWindowA
SystemParametersInfoA
GetCursorPos
PtInRect
GetWindow
GetLastActivePopup
SetWindowsHookExA
CallNextHookEx
GetKeyState
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
GetDlgCtrlID
GetWindowPlacement
GetForegroundWindow
GetMessagePos
GetMessageTime
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
UnregisterClassA
AdjustWindowRectEx
MapWindowPoints
GetSysColorBrush
LoadStringA
SetMenuItemBitmaps
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuInfo
GetMenuState
GetMenuItemRect
GetMenuItemInfoA
GetMenuStringA
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuA
GetMenuItemCount
AppendMenuA
DestroyMenu
LoadMenuA
GetSystemMenu
CreatePopupMenu
CreateMenu
ReleaseDC
GetDC
GetDialogBaseUnits
SendDlgItemMessageA
SetDlgItemTextA
GetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
CreateDialogParamA
DialogBoxParamA
GetClassInfoExA
RegisterClassExA
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageA
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetSysColor
FillRect
SetClassLongA
GetClassLongA
SetRect
SetWindowRgn
RemovePropA
GetPropA
SetPropA
MessageBoxA
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
EnableWindow
IsWindowEnabled
ShowWindow
IsWindowVisible
SetParent
PostMessageA
SetWindowPos
MoveWindow
UpdateWindow
ValidateRect
InvalidateRect
ScreenToClient
GetClassNameA
SetFocus
GetFocus
GetWindowRect
GetParent

gdi32

GetStockObject
GetObjectA
CreateCompatibleDC
CreateDIBSection
DeleteDC
SelectObject
BitBlt
ExtCreateRegion
DeleteObject
CreateRoundRectRgn
StretchBlt
CreateSolidBrush
CreatePatternBrush
SetTextColor
SetBkMode
SetBkColor
CombineRgn
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps

shell32

DragAcceptFiles
Shell_NotifyIconA
DragFinish
DragQueryFileA

comctl32

InitCommonControlsEx
ord17

wininet

InternetOpenUrlA
HttpQueryInfoA
InternetGetConnectedState
InternetOpenA
InternetCloseHandle
InternetReadFile

atl

ord42

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

Sections

.text
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

adf83af71e58fb2c4ed0dfcff4d7dfb3

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

gdi32

shell32

comctl32

wininet

atl

winspool.drv

advapi32

Sections

.text Size: 160KB - Virtual size: 157KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 24KB - Virtual size: 133KB

.rsrc Size: 96KB - Virtual size: 95KB

.text
Size: 160KB - Virtual size: 157KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 24KB - Virtual size: 133KB

.rsrc
Size: 96KB - Virtual size: 95KB