blackmoon | e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc

Sharing

Copy URL Twitter E-mail

General

Target
e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc
Size 245KB
Sample230311-jk67fagh55
SHA256 e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc
MD5 a1b5db348d455b61166c195b497613ed
SHA1 5fb8d784f553d91d404bf0d888593d8ea24faa13
SHA512 bb1cbe87cf5081c6f4f92d9f4e057820ff81428fcf0ddf2a9e651c59973c55532ecb617fe84f6fb0d2cd01ce306e0e69d3202b34ec4e9ab3897c10da5a05e189
SSDEEP 3072:Bft58XspVgsikEws3SdAhhr0e25n69Hs0FAg0FuX4tHw7UfEkGxxxxD:BfP88qQdk0R5n69HsKAOzQls
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

File Explorer

e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc

.exe 245KB

e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc

IMPHASH 28c13e8103e1fa5df002f405e5147005
SHA256 e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc
MD5 a1b5db348d455b61166c195b497613ed
SHA1 5fb8d784f553d91d404bf0d888593d8ea24faa13
SHA512 bb1cbe87cf5081c6f4f92d9f4e057820ff81428fcf0ddf2a9e651c59973c55532ecb617fe84f6fb0d2cd01ce306e0e69d3202b34ec4e9ab3897c10da5a05e189
SSDEEP 3072:Bft58XspVgsikEws3SdAhhr0e25n69Hs0FAg0FuX4tHw7UfEkGxxxxD:BfP88qQdk0R5n69HsKAOzQls
MD5 SHA1 SHA512 SSDEEP

windows x86

Detect Blackmoon payload

PE Signature issue

Digest

0f:2b:5b:1c:d0:fb:08:ac:92:ba:6e:fc:89:8d:e6:17:ef:01:a5:92:ba:f7:26:44:e1:5e:83:1c:d9:11:fc:02

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

PE Signature issue

Digest

2e:69:50:dd:ee:bb:f7:84:74:ab:d7:b8:48:5a:fc:25:9f:08:f1:c8

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Tencent Technology(Shenzhen) Company Limited,ST=Hubei,C=China,1.2.840.113549.1.9.1=#0c0e54656e63656e744071712e636f6d

Serial Number

40:2f:79:25:c2:e1:d6:8b:4c:82:a3:c9:8b:ff:44:48

Issuer

CN=Tencent Technology(Shenzhen) Company Limited,ST=Hubei,C=China,1.2.840.113549.1.9.1=#0c0e54656e63656e744071712e636f6d

Timespan

Mar 9, 2023 - Dec 24, 2040

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Tencent Technology(Shenzhen) Company Limited,ST=Hubei,C=China,1.2.840.113549.1.9.1=#0c0e54656e63656e744071712e636f6d

Serial Number

40:2f:79:25:c2:e1:d6:8b:4c:82:a3:c9:8b:ff:44:48

Issuer

CN=Tencent Technology(Shenzhen) Company Limited,ST=Hubei,C=China,1.2.840.113549.1.9.1=#0c0e54656e63656e744071712e636f6d

Timespan

Mar 9, 2023 - Dec 24, 2040

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

111462

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar LocalAlloc RtlMoveMemory LocalFree IsBadReadPtr IsBadCodePtr BeginUpdateResourceA lstrcpynW UpdateResourceA EndUpdateResourceA CreateWaitableTimerA SetWaitableTimer GetProcessHeap GetModuleHandleA ExitProcess HeapAlloc HeapReAlloc HeapFree GetProcAddress CreateDirectoryA CreateFileA WritePrivateProfileStringA WriteFile SetFilePointer DeleteFileA CopyFileA MoveFileA SetFileAttributesA GetUserDefaultLCID CreateProcessA GetModuleFileNameA ReadFile GetFileSize FindNextFileA FindFirstFileA FindClose GetCommandLineA FreeLibrary LoadLibraryA EnterCriticalSection InitializeCriticalSection LeaveCriticalSection LCMapStringA CreateFileW WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW GetConsoleMode GetConsoleCP HeapSize Sleep TerminateProcess OpenProcess GetCurrentProcess Process32Next CloseHandle Process32First CreateToolhelp32Snapshot lstrcpyn WideCharToMultiByte GetTempPathW lstrlenW LoadLibraryW FlushFileBuffers IsProcessorFeaturePresent IsValidCodePage GetOEMCP GetACP GetCPInfo IsDebuggerPresent UnhandledExceptionFilter RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount HeapSetInformation GetStartupInfoW GetLastError RtlUnwind SetUnhandledExceptionFilter GetModuleHandleW DecodePointer GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount

user32

TranslateMessage FillRect DrawIconEx ReleaseDC PeekMessageA GetDC DispatchMessageA GetMessageA wsprintfA MessageBoxA GetInputState MsgWaitForMultipleObjects

gdi32

GdiFlush BitBlt CreateDIBSection DeleteObject DeleteDC CreateSolidBrush SelectObject CreateCompatibleBitmap CreateCompatibleDC

shell32

SHGetSpecialFolderPathW ExtractAssociatedIconA

ole32

CoUninitialize CoCreateInstance OleRun CLSIDFromString CLSIDFromProgID CoInitialize

shlwapi

PathFindFileNameA PathFileExistsA PathFindExtensionA

oleaut32

VariantTimeToSystemTime LoadTypeLi LHashValOfNameSys RegisterTypeLi VariantCopy SafeArrayCreate SysAllocString VariantClear SafeArrayDestroy