blackmoon | 6b1a9d76f3baa944f8570dc96[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

6b1a9d76f3baa944f8570dc96.exe
Size

140KB
MD5

11ece72810c171174bf523e8a6d3d7ee
SHA1

e8f224fc3f34758bec69249dbd437a828b06fda0
SHA256

6b1a9d76f3baa944f8570dc9612fcb24c519f3cfc3098dc590d2618297b99e7f
SHA512

325124b64cdb439065f161d8f342e0cd833a2f58fb021c3763cf82198e6598b178ccbb45f9d5f31f74bc303b9a0da17dbece68c6edacf32b53cce92c56ae371c
SSDEEP

3072:MtR1csuBZgfAZoHd3O5pwHtZ48U11rF3:MtDVXfWJwr4t1r

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon
Detect Blackmoon payload 1 IoCs

Processes:

resource yara_rule

sample family_blackmoon
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

6b1a9d76f3baa944f8570dc96.exe

resource	yara_rule
sample	family_blackmoon

resource
6b1a9d76f3baa944f8570dc96.exe

Files

6b1a9d76f3baa944f8570dc96.exe
.dll windows x86

b3a2ba1ff96584cfbf6a8ca34a2eecea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
GetExitCodeProcess
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
CreateDirectoryA
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
WriteFile
CreateFileA
CopyFileA
MoveFileA
SetFileAttributesA
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLCID
WaitForSingleObject
GetStartupInfoA
GetVersionExA
GetCommandLineA
GetModuleFileNameA
LCMapStringA
PeekNamedPipe
CreateProcessA
CreatePipe
lstrcpyn
FlushFileBuffers
SetStdHandle
LCMapStringW
IsBadCodePtr
SetUnhandledExceptionFilter
SetFilePointer
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
RtlMoveMemory
LocalSize
LocalFree
LocalAlloc
CloseHandle
SetWaitableTimer
GetStringTypeA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
IsBadWritePtr
VirtualAlloc
RaiseException
CreateWaitableTimerA
GetLocalTime
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetLastError
GetCurrentProcess
GetVersion
RtlUnwind
GetCurrentThreadId
VirtualFree

user32

GetWindow
PostMessageA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
GetInputState
CallWindowProcA
SendMessageA
GetWindowThreadProcessId
FindWindowA
FindWindowExA
MsgWaitForMultipleObjects
MoveWindow
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
GetClassNameA
EnumChildWindows
GetDesktopWindow

advapi32

RegEnumValueA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegQueryValueExA
RegQueryInfoKeyA
RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA

ole32

CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoInitialize
OleRun
CoUninitialize

wininet

InternetSetOptionA

oleaut32

LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime

shlwapi

PathFileExistsA
PathIsDirectoryA

shell32

SHGetSpecialFolderPathA

Exports

Exports

nf_addRule
nf_adjustProcessPriviledges
nf_deleteRules
nf_disableFiltering
nf_free
nf_getConnCount
nf_getProcessNameA
nf_getProcessNameW
nf_init
nf_registerDriver
nf_setTCPTimeout
nf_tcpClose
nf_tcpDisableFiltering
nf_tcpPostReceive
nf_tcpPostSend
nf_tcpSetConnectionState
nf_tcpSetSockOpt
nf_udpDisableFiltering
nf_udpPostReceive
nf_udpPostSend
nf_udpSetConnectionState
nf_unRegisterDriver

Sections

.text
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3a2ba1ff96584cfbf6a8ca34a2eecea

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

wininet

oleaut32

shlwapi

shell32

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 94KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 20KB - Virtual size: 95KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 96KB - Virtual size: 94KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 20KB - Virtual size: 95KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB