blackmoon | 01178199[.]exe

General

Target

01178199.exe
Size

113KB
MD5

82414dead2dfee972e3943c9e26738bc
SHA1

0a77ce21a5e3697e805630953b73911f562ff1b2
SHA256

3dd7f8db8a449765b1e0932394a1b310229ad492ca943ab396fa8d709446dfa9
SHA512

75dd77f3a123203196b968449316281518155d77a48ba26dd4d6fcdcfb358e40c102ec519b992db6e74343712cc361d87b0c7d6dac8ca9a761e47b0089ee8c67
SSDEEP

1536:DooBspOAAkGafox1bZoFcbxM+ebZz+x4X5IPFmSpvXkWfCxaIK7VDIc9Vb:DTB2AkvoiW++ebZcGcmgvXkcC7K7K6F

Score

10^/10

upx blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/out.upx	family_blackmoon

ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.

Processes:

resource yara_rule

sample acprotect
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx

resource	yara_rule
sample	acprotect

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

Processes:

resource
01178199.exe
unpack001/out.upx