blackmoon | 8bf0d45b09380ba6cb45ee133c2affbc8d3375fef3cc5f07a2f9938bbdfb1ed8

Sharing

Copy URL

Twitter E-mail

General

Target

8bf0d45b09380ba6cb45ee133c2affbc8d3375fef3cc5f07a2f9938bbdfb1ed8
Size

584KB
MD5

88bed23353ad066b291a88bfb148de4d
SHA1

cfd581355df8cd3bba38078d8c74701c408efa61
SHA256

8bf0d45b09380ba6cb45ee133c2affbc8d3375fef3cc5f07a2f9938bbdfb1ed8
SHA512

e6f3b1ee76571962656ffa3421d973b09b30e49a5072f1228c007a6f3a5ed101c0495f419e7dcd7206d712a3a33a39593794997a2cf01378d0634705295f5ecc
SSDEEP

6144:L6L8N6uMOEzfXKx6gTVfXbJ3HfP20TGtdXunQJqTYn9tUhgzHK4PN8AbCszeT:eL8N6uMOEzv8V/bJ5G/uXYn/zq4VNWR

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon
Detect Blackmoon payload 1 IoCs

Processes:

resource yara_rule

sample family_blackmoon

resource	yara_rule
sample	family_blackmoon

Files

8bf0d45b09380ba6cb45ee133c2affbc8d3375fef3cc5f07a2f9938bbdfb1ed8
.exe windows x86

6aee782a261dde1cae6413d1248b3e84

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32First
CloseHandle
Process32Next
Module32First
GetSystemDirectoryA
GetCurrentProcess
OpenProcess
QueryDosDeviceA
TerminateProcess
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
FindClose
FindFirstFileA
FindNextFileA
CreateFileA
GetFileSize
ReadFile
GetEnvironmentVariableA
DeleteFileA
GetModuleFileNameA
Sleep
GetTickCount
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
SetWaitableTimer
CreateWaitableTimerA
LocalAlloc
WideCharToMultiByte
ReadProcessMemory
Module32Next
VirtualQueryEx
GetCurrentProcessId
CreateToolhelp32Snapshot
LocalSize
SetStdHandle
IsBadCodePtr
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GlobalLock
LocalFree
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
LeaveCriticalSection
GlobalReAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
lstrcpynA
lstrlenA
GlobalFlags
InterlockedDecrement
WritePrivateProfileStringA
lstrcatA
lstrcpyA
InterlockedIncrement
MultiByteToWideChar
SetLastError
GetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVersion
GetProcessVersion
SetErrorMode
WriteFile
SetFilePointer
FlushFileBuffers
GetCPInfo
GetOEMCP
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadWritePtr
VirtualAlloc
RaiseException
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
InitializeCriticalSection
TerminateProcess
RtlUnwind
GetVersion
GetCommandLineA
LCMapStringA
GetProcAddress
FreeLibrary
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetModuleHandleA
LoadLibraryA
RtlMoveMemory
InterlockedIncrement
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
SetFilePointer
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringW
SetStdHandle
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
CloseHandle
GetOEMCP
GetCurrentProcess
InterlockedDecrement

user32

MsgWaitForMultipleObjects
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
PostQuitMessage
PostMessageA
SendMessageA
SetCursor
EnableWindow
GetWindowLongA
IsWindowEnabled
GetLastActivePopup
GetParent
SetWindowsHookExA
GetCursorPos
IsWindowVisible
ValidateRect
CallNextHookEx
GetKeyState
GetActiveWindow
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
GetClassNameA
PtInRect
GetWindowRect
GetDlgCtrlID
GetWindow
ClientToScreen
SetWindowTextA
GetWindowTextA
UnhookWindowsHookEx
GetMenuItemCount
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
IsWindow
SetWindowLongA
SetWindowPos
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
GetWindowThreadProcessId
SetTimer
CreateWindowExA
GetMessageA
PeekMessageA
GetClassInfoExA
UnregisterClassA
MessageBoxA
wsprintfA

gdi32

DeleteObject
DeleteDC
SaveDC
RestoreDC
SelectObject
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
GetStockObject
GetDeviceCaps
CreateBitmap

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA

psapi

GetProcessImageFileNameA

shlwapi

PathFileExistsA

comctl32

ord17

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

Sections

.text
Size: 268KB - Virtual size: 266KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 280KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6aee782a261dde1cae6413d1248b3e84

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

psapi

shlwapi

comctl32

winspool.drv

Sections

.text Size: 268KB - Virtual size: 266KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 280KB - Virtual size: 342KB

.rsrc Size: 4KB - Virtual size: 964B

.text
Size: 268KB - Virtual size: 266KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 280KB - Virtual size: 342KB

.rsrc
Size: 4KB - Virtual size: 964B