blackmoon | f7d513e4b1ee06925a64fa6a8cf2caf23380a445060049fd1bb39285039068ad

Sharing

Copy URL

Twitter E-mail

General

Target

f7d513e4b1ee06925a64fa6a8cf2caf23380a445060049fd1bb39285039068ad
Size

3.3MB
MD5

bdd6dca884047ed569d7c551100b17de
SHA1

68e27db7b6c8385f8d540d020251286e6551500b
SHA256

f7d513e4b1ee06925a64fa6a8cf2caf23380a445060049fd1bb39285039068ad
SHA512

4adb91eb270fe8197bfd763afa017dc1f5cc23b9819e3008d3e9ae52cad2f706434adf257e24a3b8fcb8d2c89bb78bf23707be73912bb4ae3a646e7a76c30130
SSDEEP

49152:BNy3ijPCEKEQIvufRoGpsnMnn5xxiDpdKJUlzCg6SmA5hu:B6YzLYoGpnn5xLuJCg6Smmhu

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon
Detect Blackmoon payload 1 IoCs

Processes:

resource yara_rule

sample family_blackmoon

resource	yara_rule
sample	family_blackmoon

Files

f7d513e4b1ee06925a64fa6a8cf2caf23380a445060049fd1bb39285039068ad
.exe windows x86

6eeaae932d2c99143282e441e0062788

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnhandledExceptionFilter
GetACP
TerminateProcess
HeapSize
RaiseException
RtlUnwind
FlushFileBuffers
SetFilePointer
ReadFile
FreeEnvironmentStringsA
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
GlobalFlags
lstrcmpA
GetProcessVersion
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetLastError
SetLastError
GetVersion
InterlockedDecrement
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalAlloc
GlobalReAlloc
GlobalLock
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
GetCurrentThreadId
lstrlenA
lstrcpynA
lstrcpyA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
CreateToolhelp32Snapshot
InterlockedExchange
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
DeleteFileA
GetTickCount
ReadConsoleA
Sleep
GetStdHandle
WriteFile
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetCommandLineA
GetModuleHandleA
CreateFileA
DeviceIoControl
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
LocalFree
LocalAlloc
OpenProcess
GetCurrentProcess
Process32Next
CloseHandle
lstrcatA
SetErrorMode
Process32First

advapi32

CreateServiceA
DeleteService
ControlService
StartServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA

user32

MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
SetWindowsHookExA
GrayStringA
DrawTextA
TabbedTextOutA
DestroyMenu
PostQuitMessage
ClientToScreen
PtInRect
GetClassNameA
GetDC
ReleaseDC
GetSysColorBrush
LoadCursorA
IsWindowEnabled
SetWindowTextA
LoadIconA
PostMessageA
MapWindowPoints
GetSysColor
SetFocus
AdjustWindowRectEx
GetClientRect
CopyRect
EnableWindow
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetParent
GetNextDlgTabItem
LoadStringA
UnhookWindowsHookEx
SendMessageA
GetKeyState
CallNextHookEx

gdi32

PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetStockObject
GetObjectA
SetViewportExtEx

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comctl32

ord17

Sections

.text
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.2MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6eeaae932d2c99143282e441e0062788

Headers

File Characteristics

Imports

kernel32

advapi32

user32

gdi32

winspool.drv

comctl32

Sections

.text Size: 104KB - Virtual size: 102KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 3.2MB - Virtual size: 3.3MB

.rsrc Size: 4KB - Virtual size: 664B

.text
Size: 104KB - Virtual size: 102KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 3.2MB - Virtual size: 3.3MB

.rsrc
Size: 4KB - Virtual size: 664B