blackmoon | tmp

Sharing

Copy URL

Twitter E-mail

General

Target

tmp
Size

1.1MB
MD5

e39c25789ab24d180fa917c9007bc924
SHA1

bf92a766f20049be5e50368f58f3805fd82905a0
SHA256

644ac642378569039c33224394ac8f3be5c3c09b1fb746ab25142f568b156f69
SHA512

d24ad688ad48cc6d26d6dd30f207c5e750d45097517efccbc831ec4d268c0179844bec640ee0f9e2b352b6879d493c92723908aa30b2176215ff43d0564a2c94
SSDEEP

24576:UojFgm74ZoxJ/kJOXJL+5ozolSHtn2mKgSNe5FOphi0joI19H:Ust/kJosS0mK9WOzi0v

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Files

tmp
.exe windows x86

aac848e801381769c8eac5561ecdc278

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateProcess
OpenProcess
CreateProcessA
ResumeThread
IsWow64Process
GlobalAlloc
RtlMoveMemory
GlobalFree
CreateThread
MultiByteToWideChar
ReadProcessMemory
WriteProcessMemory
GetModuleHandleA
GetProcAddress
lstrcpynA
VirtualAllocEx
VirtualFreeEx
WaitForSingleObject
GetExitCodeThread
CreateRemoteThread
LoadLibraryA
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetLocalTime
DeleteFileA
FindClose
FindFirstFileA
GetStartupInfoA
GetModuleFileNameA
SetWaitableTimer
CreateFileA
CreateDirectoryA
SetFilePointer
ReadFile
GetFileSize
GetTickCount
SetFileAttributesA
GetCommandLineA
FreeLibrary
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
LCMapStringW
GetOEMCP
GetACP
GetCPInfo
HeapSize
RaiseException
CreateWaitableTimerA
GetCurrentProcessId
WriteFile
DeleteCriticalSection
SystemTimeToFileTime
GetFileAttributesA
GetCurrentDirectoryA
LocalFileTimeToFileTime
SetFileTime
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr

ws2_32

connect
htonl
recvfrom
sendto
gethostname
getsockname
ntohs
getpeername
WSAStartup
inet_ntoa
WSACleanup
gethostbyname
inet_addr
listen
closesocket
bind
htons
socket
accept
__WSAFDIsSet
select
recv
send

user32

DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects

urlmon

URLDownloadToFileA

shlwapi

PathFindFileNameA

iphlpapi

SendARP
GetAdaptersInfo

icmp

IcmpCreateFile
IcmpSendEcho
IcmpCloseHandle

Sections

.text
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 936KB - Virtual size: 987KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

aac848e801381769c8eac5561ecdc278

Headers

File Characteristics

Imports

kernel32

ws2_32

user32

urlmon

shlwapi

iphlpapi

icmp

Sections

.text Size: 204KB - Virtual size: 203KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 936KB - Virtual size: 987KB

.text
Size: 204KB - Virtual size: 203KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 936KB - Virtual size: 987KB