blackmoon | acb67e2665d3fc0c337728053104e4763cab0b2f422f3d1f8658fd5ab01a375b

Sharing

Copy URL Twitter E-mail

General

Target

acb67e2665d3fc0c337728053104e4763cab0b2f422f3d1f8658fd5ab01a375b
Size

384KB
MD5

353fe1ea27bdc78cdd7aca5cd64171f6
SHA1

c43d7be18ff43ee2c010b48949b940ca59b10d1e
SHA256

acb67e2665d3fc0c337728053104e4763cab0b2f422f3d1f8658fd5ab01a375b
SHA512

a0a481c24730671485b85a4a899bd7dbab05c8c556447d2a327cf8fd285b6b7e2d4663d7f1151e6be79b3e9f07e48e4624de963bc96ecce7ab801d6f821ad4e8
SSDEEP

6144:QGaE22oZodGqrvNs8+q0VZApw6WcUldc7BnHUrgTBGv+B:QXE22omGGNs8+5+pw6ZUI7BHigTsv+B

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
acb67e2665d3fc0c337728053104e4763cab0b2f422f3d1f8658fd5ab01a375b

Files

acb67e2665d3fc0c337728053104e4763cab0b2f422f3d1f8658fd5ab01a375b
.exe windows x86

fd3791b6c1c5deddd854fd3a56a47fb7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32Next
MoveFileA
CreateProcessA
OpenProcess
TerminateProcess
CreateThread
VirtualAlloc
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrcpynA
VirtualQueryEx
ReadProcessMemory
RtlMoveMemory
VirtualFree
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
DeleteFileA
CloseHandle
ReadFile
Process32First
CreateFileA
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
GetCommandLineA
GetTickCount
WriteFile
GetStartupInfoA
FreeLibrary
LCMapStringA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
CreateToolhelp32Snapshot
GetFileSize
WaitForSingleObject
GetStringTypeW
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
LCMapStringW
IsBadWritePtr
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA

user32

GetDesktopWindow
DispatchMessageA
PeekMessageA
GetMessageA
TranslateMessage
CallWindowProcA
wsprintfA
MessageBoxA
GetClassNameA
GetWindowThreadProcessId
GetWindow

shlwapi

PathFileExistsA

Sections

.text
Size: 188KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fd3791b6c1c5deddd854fd3a56a47fb7

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

Sections

.text Size: 188KB - Virtual size: 184KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 172KB - Virtual size: 236KB

.rsrc Size: 12KB - Virtual size: 10KB

.text
Size: 188KB - Virtual size: 184KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 172KB - Virtual size: 236KB

.rsrc
Size: 12KB - Virtual size: 10KB